Terminal honeypot construction method based on large language model, electronic equipment and storage medium
By constructing a terminal honeypot based on a large language model, responses that conform to the behavior logic of real systems are dynamically generated. This solves the problems of dynamic response and semantic coherence in existing honeypot solutions, improves the concealment and deception success rate of honeypots, and achieves low-cost and highly adaptable network defense.
Patent Information
- Application Number
- CN202511682677.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-17
- Publication Date
- 2026-02-10
AI Technical Summary
Existing honeypot solutions based on large language models are difficult to respond dynamically, maintain semantic coherence, are easily detected by attackers, cannot adapt to complex and ever-changing attack patterns, and consume a lot of resources.
We adopt a terminal honeypot construction method based on a large language model. We construct prompt words through a prompt word manager, combine an importance assessment system and time localization processing to generate responses that conform to the behavior logic of real systems, dynamically prune interaction history, and use an exception handling mechanism to simulate the complex behavior of real systems.
It improves the concealment and deception success rate of honeypots, reduces the risk of being identified by attackers, and achieves low-cost, highly adaptable network defense.
Smart Images
Figure CN121508972A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security defense technology, specifically to a method for constructing terminal honeypots based on a large language model, an electronic device, and a storage medium. Background Technology
[0002] A honeypot is a proactive defense technology that lures attackers by simulating real systems or services, thereby collecting attack behavior data, analyzing attack methods, and enhancing network security protection capabilities. However, traditional honeypot technology has significant shortcomings in terms of flexibility, interactivity, and deception. Staticly deployed honeypots struggle to adapt to dynamically changing attack methods, low-interaction honeypots have limited simulation capabilities, while high-interaction honeypots consume large amounts of resources and are easily countered by attackers.
[0003] In recent years, Large Language Models (LLMs) have made significant progress in natural language processing, code generation, and intelligent dialogue, and have begun to be applied in the field of cybersecurity. LLMs possess powerful natural language processing and contextual understanding capabilities, which theoretically can effectively improve the interactivity and intelligence of honeypot systems. However, existing honeypot solutions based on LLMs typically rely on fixed prompt scripts, making it impossible to dynamically adjust responses based on attacker behavior. This makes them ill-suited to complex and ever-changing attack patterns, and they lack contextual semantic coherence when dealing with continuous attacks. Furthermore, LLMs are prone to revealing their characteristics when processing time-sensitive instructions or encountering API call anomalies, leading to their vulnerability to attackers.
[0004] Therefore, there is an urgent need for an intelligent terminal honeypot solution that can respond dynamically, maintain semantic coherence, and possess high stealth. Summary of the Invention
[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a terminal honeypot construction method based on a large language model. This method can dynamically generate responses that conform to the behavior logic of real systems, maintain the semantic coherence of multi-round attack interactions, and effectively improve the concealment and deception success rate of the honeypot.
[0006] To achieve the above objectives, the present invention adopts the following technical solution: a terminal honeypot construction method based on a large language model, comprising the following steps:
[0007] In response to an attacker's attack command input via a terminal emulator, a prompt word manager constructs a prompt word, which includes at least a preset prompt word, interaction history, and the attack command.
[0008] Determine whether the attack command is a time-based command. If so, perform time localization processing. Otherwise, determine whether the total length of the current prompt word exceeds the preset maximum number of tokens. If it does not exceed the maximum number of tokens, input the prompt word into the large language model to generate a response and update the interaction history. If it exceeds the maximum number of tokens, dynamically prune the records in the interaction history based on a preset importance assessment system until the total length of the prompt word does not exceed the maximum number of tokens. Then, input the pruned prompt word into the large language model to generate a response and update the interaction history.
[0009] The generated response is returned to the attacker to simulate the behavior of the real system.
[0010] Further, it is determined whether the attack command is a time-related command. If so, time localization processing is performed, specifically as follows:
[0011] If the attack command is a time-sensitive command, it bypasses the large language model, directly calls the host system's local function to obtain the current system time, formats it as a standard timestamp as a response, and returns the response to the terminal emulator.
[0012] Furthermore, the dynamic pruning of records in the interaction history based on the preset importance assessment system specifically involves:
[0013] Traverse each record in the interaction history and determine the importance assessment value of each record according to the importance assessment system;
[0014] Prioritize pruning the least important records until the total length of the prompt words does not exceed the maximum number of tokens;
[0015] The importance assessment system divides operational instructions into multiple levels, with higher levels indicating stronger semantic criticality in the attack chain.
[0016] Further, the determination of whether the total length of the current prompt word exceeds the preset maximum number of tokens; if it does not exceed the maximum number of tokens, the prompt word is input into the large language model to generate a response and the interaction history is updated; if it exceeds the maximum number of tokens, the records in the interaction history are dynamically pruned based on a preset importance assessment system until the total length of the prompt word does not exceed the maximum number of tokens, and then the pruned prompt word is input into the large language model to generate a response and the interaction history is updated. This is achieved through a dynamic prompt word update algorithm based on thought chain, specifically including the following steps:
[0017] S1, Input attacker query Q i Preset prompt words S, interaction history H i and the maximum number of tokens, maxtoken;
[0018] S2. Calculate the total length L = length(Q) i) + length(S) + length(H i If L ≤ maxtoken, then execute step S3; otherwise, execute step S5.
[0019] S3. Generate prompt word. i = S + H i + Q i And input the large language model to generate answer A i = LLM(Prompt i Then, for the generated answer A i An importance assessment was conducted, resulting in an assessment value I. i After the evaluation is completed, the new answer A will be provided. i Add to interaction history H i The front end forms an updated interaction history H i = A i + H i Then return to answer A. i ;
[0020] S5. If L > maxtoken, then repeat the following steps until L ≤ maxtoken, then return the answer A. i :
[0021] a. Initialize the minimum importance value min_I to a maximum value, and the minimum importance index min_index to -1;
[0022] b. Traverse the interaction history H i For each record j in the dataset, if its importance assessment value is I... j < min_I, then update min_I= I j min_index = j;
[0023] c. After the traversal is complete, if min_index ≠ -1, meaning the least important record has been found, then start from the interaction history H. i Delete record H i [min_index];
[0024] d. Generate prompt word i = S + H i + Q i And input the large language model to generate answer A i = LLM(Prompt i Then assess its importance and update the interaction history H. i = A i + H i.
[0025] Furthermore, the importance assessment value is determined based on a four-level importance assessment system, which includes the following levels of importance from highest to lowest:
[0026] Level 1: System-destructive operations;
[0027] Level 2: Resource occupancy operation;
[0028] Level 3: Sensitive file operations;
[0029] Level 4: Low-risk daily operations;
[0030] Level 1 represents the highest importance, and Level 4 represents the lowest importance. The higher the importance, the greater the importance assessment value.
[0031] Furthermore, the method also includes an exception handling mechanism, specifically:
[0032] When an exception occurs when calling the large language model application interface, a standardized system error message is returned to block the environment probe detection of attackers.
[0033] Furthermore, the terminal simulator constructs the core of the interactive session based on a state machine model, uses an event sourcing mechanism to record timestamped attack command logs, and achieves real-time command parsing through non-blocking I / O technology. It creates an independent storage space for each attack session to ensure the isolation and state independence of multi-user interaction.
[0034] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.
[0035] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.
[0036] Compared with existing technologies, this invention has the following advantages: This invention provides a terminal honeypot construction method based on a large language model. This method uses the natural language generation capabilities of the large language model to simulate the complex behavior of real systems and generate responses that conform to the behavioral logic of real systems (such as permission error prompts and process status feedback), effectively avoiding attacker fingerprint identification and making this invention highly deceptive. The dynamic prompt word update mechanism based on importance assessment can cover multi-stage attacks, avoiding the semantic rigidity problem of static templates and improving the dynamic adaptability of the honeypot. It supports cloud-based large model API calls, eliminating the need to maintain a resource-intensive real system environment and achieving low-cost deployment. The exception handling mechanism and localized time response design significantly reduce the risk of being identified by attackers, improve concealment, and have broad application prospects. Attached Figure Description
[0037] Figure 1 This is a flowchart of the terminal honeypot construction method (LLM-THP) based on a large language model provided in an embodiment of the present invention;
[0038] Figure 2 This is a schematic diagram of the terminal honeypot system corresponding to the terminal honeypot construction method (LLM-THP) based on the large language model provided in this embodiment of the invention. Detailed Implementation
[0039] The present invention will be further described below with reference to the accompanying drawings and embodiments.
[0040] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.
[0041] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.
[0042] like Figure 1 As shown, this invention provides a method for constructing a terminal honeypot based on a large language model, including the following steps:
[0043] 1) In response to an attacker's attack command input via a terminal emulator, a prompt word manager constructs a prompt word, which includes at least a preset prompt word, interaction history, and the attack command;
[0044] 2) Determine whether the attack command is a time-based command. If so, perform time localization processing. Otherwise, determine whether the total length of the current prompt word exceeds the preset maximum number of tokens. If it does not exceed the maximum number of tokens, input the prompt word into the large language model to generate a response and update the interaction history. If it exceeds the maximum number of tokens, dynamically prune the records in the interaction history based on the preset importance assessment system until the total length of the prompt word does not exceed the maximum number of tokens. Then, input the pruned prompt word into the large language model to generate a response and update the interaction history.
[0045] 3) Return the generated response to the attacker to simulate the behavior of the real system.
[0046] Specifically, the algorithm determines whether the total length of the current prompt word exceeds the preset maximum number of tokens. If it does not exceed the maximum number of tokens, the prompt word is input into the large language model to generate a response and the interaction history is updated. If it exceeds the maximum number of tokens, the records in the interaction history are dynamically pruned based on a preset importance assessment system until the total length of the prompt word does not exceed the maximum number of tokens. The pruned prompt word is then input into the large language model to generate a response and the interaction history is updated. This is achieved through a dynamic prompt word update algorithm based on the thought chain (Algorithm 1).
[0047] The specific implementation process of the dynamic prompt word update algorithm (Algorithm 1) based on the thought chain is as follows:
[0048] S1, Input attacker query Q i Preset prompt words S, interaction history H i and the maximum number of tokens, maxtoken;
[0049] S2. Calculate the total length L = length(Q) i ) + length(S) + length(H i If L ≤ maxtoken, then execute step S3; otherwise, execute step S5.
[0050] S3. Generate prompt word. i = S + H i + Q i And input the large language model to generate answer A i = LLM(Prompt i Then, for the generated answer A i An importance assessment was conducted, resulting in an assessment value I. i After the evaluation is completed, the new answer A will be provided. i Add to interaction history H i The front end forms an updated interaction history H i = A i + Hi Then return to answer A. i ;
[0051] S5. If L > maxtoken, it is necessary to reduce the interaction history H. i To make room and ensure that new inputs do not exceed the limit, the following steps are performed repeatedly until L ≤ maxtoken, then the answer A is returned. i :
[0052] a. Initialize the minimum importance value min_I to a maximum value, and the minimum importance index min_index to -1;
[0053] b. Traverse the interaction history H i For each record j in the dataset, if its importance assessment value is I... j < min_I, then update min_I= I j min_index = j;
[0054] c. After the traversal is complete, if min_index ≠ -1, meaning the least important record has been found, then start from the interaction history H. i Delete record H i [min_index] is used to reduce the total number of tokens;
[0055] d. Generate prompt word i = S + H i + Q i And input the large language model to generate answer A i = LLM(Prompt i Then assess its importance and update the interaction history H. i = A i + H i .
[0056] The importance assessment value is determined based on a four-level importance assessment system, which divides operational instructions into multiple levels, with higher levels indicating stronger semantic criticality in the attack chain. The importance assessment system, ranked from highest to lowest importance, includes:
[0057] Level 1: System-destructive operations;
[0058] Level 2: Resource occupancy operation;
[0059] Level 3: Sensitive file operations;
[0060] Level 4: Low-risk daily operations.
[0061] Level 1 represents the highest importance, and Level 4 represents the lowest importance. The higher the importance, the greater the importance assessment value.
[0062] Determine whether the attack command is a time-related command; if so, perform time localization processing, specifically:
[0063] If the attack command is a time-sensitive command (such as "date"), the large language model is bypassed, and the host system's local function `datetime.now()` is directly called to return the real-time timestamp. Simultaneously, the input command is evaluated in the main function; when the user inputs "date", `get_local_time()` is called to return the current terminal's system time. The method also includes an exception handling mechanism: when an exception occurs while calling the large language model's application programming interface, a standardized system error message is returned to block the attacker's environment probe detection.
[0064] When large language models answer time-related questions, they actually select a random time before model training as the answer. This is because the training data for large language models only contains information up to the training time and cannot capture or predict events that occurred afterward. Therefore, when generating time-related answers, large language models actually give random responses based on existing data. To solve the problem of time inconsistency, a preset is made for the "date" command in the LLM-THP code. When a user accesses and retrieves the system time, the current terminal time is returned instead of being processed by the large language model. As shown in the code below, a function `get_local_time()` is constructed. This function uses the "datetime" library file and calls the `datetime.now()` function to retrieve and return the current system time. Simultaneously, the input command is checked in the main function; when the user enters "date", `get_local_time()` is called to return the current terminal system time. This method effectively solves the shortcomings of large language models in answering time-related questions and improves the answering speed for such questions. Partial code is shown below:
[0065] # Get local time
[0066] def get_local_time():
[0067] current_time = datetime.datetime.now()
[0068] return current_time.strftime("%a %b %d %H:%M:%S UTC %Y")
[0069] if user_input.strip().lower() == "date":
[0070] # Return local time as command output
[0071] print(get_local_time())
[0072] continue
[0073] The terminal honeypot construction method based on a large language model provided by this invention, along with the corresponding terminal honeypot system and its workflow, are as follows: Figure 2 As shown. The system contains two important modules: a terminal emulator and a prompt word manager.
[0074] The terminal simulator is responsible for directly interacting with the attacker. By simulating a session terminal, it accepts attack commands input by the attacker and outputs feedback from the large model to these commands. The implementation principle of the terminal simulator is as follows: its instantiation process establishes a timestamped interaction log storage structure "session_history," and fully records the evolution characteristics of the attack chain through the "EventSourcing" mode. The interaction loop "start_session" integrates an interactive command-line interface, and simultaneously uses non-blocking I / O technology to achieve real-time parsing of user input and asynchronous response generation. The timestamped interaction log and event sourcing effectively enhance the prompt word manager's management of dialogue memory, thereby improving LLM-THP's understanding of the correlation between previous and subsequent attacks.
[0075] The following is a portion of the terminal emulator code:
[0076] class HoneypotTerminal:
[0077] def init(self):
[0078] self.gpt_client = HoneypotGPTClient()
[0079] self.session_history = [] # Interaction history with timestamps
[0080] def start_session(self):
[0081] while True:
[0082] user_input = self._read_command_line()
[0083] response = self.gpt_client.generate_response(user_input)
[0084] self._print_response(response)
[0085] The GPTClient class, a prompt word manager, handles attack commands input from the terminal emulator and calls large models to obtain feedback. During class initialization, it dynamically adapts to various GPT models through the abstract model loading interface "_load_gpt_model". GPTClient supports calls to OpenAI's official API and locally built large models. The preset prompt word module "prompt_preset" embeds preset system configurations and high-value system resources into the dialogue flow using the preset prompt words designed in this paper, enabling proactive capture of attacker intent. Regarding prompt word management, the dynamic prompt word update algorithm based on thought chain (Algorithm 1) designed in this method uses a dynamic priority queue "token_manager" to prune the context sequence in real time, combining importance assessment with analysis to preserve key semantics, ensuring the continuity of the adversarial session under context window constraints. GPTClient also incorporates an exception handling mechanism. This paper adopts a dual capture strategy: triggering a context reset protocol for errors where the token exceeds the limit, and returning standardized error messages for API exceptions. By designing an exception handling mechanism, system information leakage can be effectively avoided, preventing attackers from identifying the attacker's intentions.
[0086] The following is a portion of the code for the prompt word manager:
[0087] class GPTClient:
[0088] def __init__(self, model_name="gpt-4o"):
[0089] self.model = self._load_gpt_model(model_name)
[0090] self.prompt_preset = <preset prompt word>
[0091] self.token_manager = <Algorithm 1>
[0092] def _load_gpt_model(self, model_name): # Function to load the large model
[0093] config = {
[0094] "api_key": os.getenv("API_KEY"),
[0095] "base_url":os.getenv("API_BASE_URL","https: / / api.openai.com / v1")
[0096] }
[0097] print(f"Initializing {model_name} engine...")
[0098] return lambda prompt: f"GPT Response to: {prompt}"
[0099] def generate_response(self, raw_input):
[0100] try:
[0101] # 1. Assemble input commands and prompts
[0102] engineered_prompt = self.prompt_preset.apply(safe_input)
[0103] # 2. Dynamic Update Algorithm for Prompt Words Based on Mind Chain
[0104] processed_prompt = self.token_manager.optimize(engineered_prompt)
[0105] # 3. Large Model Call
[0106] response = self.model(processed_prompt)
[0107] #4. Return the response of the large model
[0108] return response
[0109] except TokenOverflowException as e: # Context overflow exception handling
[0110] return self.token_manager.emergency_response()
[0111] except APICallError as e: # Disguise as a normal error response
[0112] return "Error processing request: {}".format(str(e))
[0113] To facilitate understanding of the LLM-THP interaction process, this article presents a specific interaction example. Details of the example are as follows... Figure 1 As shown. When an attacker wants to query the current system directory, they input the "ls" command into the terminal emulator. This command's information is added to the attack command. The attack command is a variable that is overwritten each time a new command is input. At this point, the prompt manager constructs a complete Prompt from the attack command, the basic prompt, the additional prompt, and the interaction history. When processing this Prompt, the prompt manager first determines whether it is a time-related command. If so, it uses the system time for processing; otherwise, it proceeds to the token exceeding the limit check. This algorithm is a dynamic prompt update mechanism based on thought chains, specifically designed to handle attacker queries in Large Language Model (LLM) interactions.
[0114] This invention proposes a method for constructing terminal honeypots based on a large language model. It leverages the deep semantic understanding capabilities of the large language model to generate responses that conform to the behavioral logic of real systems (such as permission error prompts and process status feedback), effectively circumventing attacker fingerprinting. A prompt word optimization mechanism based on dynamic importance assessment overcomes the semantic rigidity limitations of static templates, exhibiting dynamic adaptability and enabling coherent trapping of multi-stage attacks by advanced persistent threats. By relying on cloud-based large model API calls, it eliminates the physical resource consumption of high-interaction honeypots, achieving low-cost deployment. The combination of time localization and anomaly handling mechanisms significantly reduces the risk of identification, providing a highly concealed, highly adaptable, and low-cost terminal deception solution for proactive network defense systems.
[0115] This embodiment also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.
[0116] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.
[0117] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0118] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0119] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0120] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0121] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.
Claims
1. A method for constructing terminal honeypots based on a large language model, characterized in that, Includes the following steps: In response to an attacker's attack command input via a terminal emulator, a prompt word manager constructs a prompt word, which includes at least a preset prompt word, interaction history, and the attack command. Determine whether the attack command is a time-related command. If so, perform time localization processing. Otherwise, determine whether the total length of the current prompt word exceeds the preset maximum number of tokens. If the limit is not exceeded, the prompt word is input into the large language model to generate a response and the interaction history is updated; If the number of tokens exceeds the limit, the records in the interaction history will be dynamically pruned based on the preset importance assessment system until the total length of the prompt words does not exceed the maximum number of tokens. Then, the pruned prompt words will be input into the large language model to generate a response and update the interaction history. The generated response is returned to the attacker to simulate the behavior of the real system.
2. The terminal honeypot construction method based on a large language model according to claim 1, characterized in that, Determine whether the attack command is a time-related command; if so, perform time localization processing, specifically: If the attack command is a time-sensitive command, it bypasses the large language model, directly calls the host system's local function to obtain the current system time, formats it as a standard timestamp as a response, and returns the response to the terminal emulator.
3. The terminal honeypot construction method based on a large language model according to claim 1, characterized in that, The dynamic pruning of records in the interaction history based on the preset importance assessment system is as follows: Traverse each record in the interaction history and determine the importance assessment value of each record according to the importance assessment system; Prioritize pruning the least important records until the total length of the prompt words does not exceed the maximum number of tokens; The importance assessment system divides operational instructions into multiple levels, with higher levels indicating stronger semantic criticality in the attack chain.
4. The terminal honeypot construction method based on a large language model according to claim 1, characterized in that, The determination is made as to whether the total length of the current prompt word exceeds the preset maximum number of tokens; If the limit is not exceeded, the prompt word is input into the large language model to generate a response and the interaction history is updated; If the number of tokens exceeds the limit, the records in the interaction history are dynamically pruned based on a preset importance assessment system until the total length of the prompt words does not exceed the maximum number of tokens. The pruned prompt words are then input into the large language model to generate a response and update the interaction history. This is achieved through a dynamic prompt word update algorithm based on thought chains, specifically including the following steps: S1, Input attacker query Q i Preset prompt words S, interaction history H i and the maximum number of tokens, maxtoken; S2. Calculate the total length L = length(Q) i ) + length(S) + length(H i If L ≤ maxtoken, then execute step S3; otherwise, execute step S5. S3. Generate prompt word. i = S + H i + Q i And input the large language model to generate answer A i = LLM(Prompt i Then, for the generated answer A i An importance assessment was conducted, resulting in an assessment value I. i After the evaluation is completed, the new answer A will be provided. i Add to interaction history H i The front end forms an updated interaction history H i = A i + H i Then return to answer A. i ; S5. If L > maxtoken, then repeat the following steps until L ≤ maxtoken, then return the answer A. i : a. Initialize the minimum importance value min_I to a maximum value, and the minimum importance index min_index to -1; b. Traverse the interaction history H i For each record j in the dataset, if its importance assessment value is I... j < min_I, then update min_I =I j min_index = j; c. After the traversal is complete, if min_index ≠ -1, meaning the least important record has been found, then start from the interaction history H. i Delete record H i [min_index]; d. Generate prompt word i = S + H i + Q i And input the large language model to generate answer A i = LLM(Prompt i Then assess its importance and update the interaction history H. i = A i + H i .
5. The terminal honeypot construction method based on a large language model according to claim 3 or 4, characterized in that, The importance assessment value is determined based on a four-level importance assessment system, which includes the following levels of importance from highest to lowest: Level 1: System-destructive operations; Level 2: Resource occupancy operation; Level 3: Sensitive file operations; Level 4: Low-risk daily operations; Level 1 represents the highest importance, and Level 4 represents the lowest importance. The higher the importance, the greater the importance assessment value.
6. The terminal honeypot construction method based on a large language model according to claim 1, characterized in that, The method also includes an exception handling mechanism, specifically: When an exception occurs when calling the large language model application interface, a standardized system error message is returned to block the environment probe detection of attackers.
7. The terminal honeypot construction method based on a large language model according to claim 1, characterized in that, The terminal simulator constructs the core of the interactive session based on a state machine model, uses an event tracing mechanism to record timestamped attack command logs, and achieves real-time command parsing through non-blocking I / O technology. It creates an independent storage space for each attack session to ensure the isolation and state independence of multi-user interaction.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1-7.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.