State snapshot-based large language model-driven ssh honeypot response control method and device, equipment and storage medium

By using explicit state snapshot representation and multi-dimensional consistency verification, the problem of inconsistent state in large language model-driven SSH honeypots during long-term interactions is solved, achieving strict self-consistency of state under arbitrary interaction length and significantly extending the honeypot's deception success time.

CN122137664APending Publication Date: 2026-06-02ELECTRIC POWER RESEARCH INSTITUTE OF STATE GRID QINGHAI ELECTRIC POWER COMPANY +1
View PDF 0 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
ELECTRIC POWER RESEARCH INSTITUTE OF STATE GRID QINGHAI ELECTRIC POWER COMPANY
Filing Date
2026-04-08
Publication Date
2026-06-02

AI Technical Summary

Technical Problem

Existing SSH honeypot systems based on large language models cannot maintain the monotonic consistency of file system state, runtime context state, and system metadata during long-term interactions, which allows attackers to quickly identify honeypots and makes it impossible to achieve long-term effective threat intelligence collection.

Method used

An explicit state snapshot representation is adopted. By obtaining the attacker's command and the current state snapshot, multiple candidate responses are generated by calling the large language model, and file system consistency, timing consistency and structural integrity are verified. Finally, the state snapshot is updated according to the target response to form a closed loop of incremental state update.

Benefits of technology

It achieves strict self-consistency of the state of the file system, runtime context, and system metadata under arbitrary interaction length, effectively suppresses phantom output, and significantly extends the number of interaction rounds required for the honeypot to be identified by the attacker.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122137664A_ABST
    Figure CN122137664A_ABST
Patent Text Reader

Abstract

This application discloses a method, apparatus, device, and storage medium for controlling the response of an SSH honeypot driven by a large language model based on state snapshots, relating to the field of network security technology. The method includes: invoking a large language model based on an attacker's command and a current state snapshot to obtain multiple candidate responses, wherein the current state snapshot includes a file system state, a context state set, and a system metadata set; verifying the file system consistency, timing consistency, and structural integrity of each candidate response, and using the verified candidate response as the target response; updating the current state snapshot based on the target response and the attacker's command to obtain the target state snapshot. This solves the technical problems of state loss due to context window limitations and the inability to maintain consistent state during long-term interactions in existing large language model-driven SSH honeypots, achieving strict self-consistency of the file system, runtime context, and system metadata states under arbitrary interaction lengths.
Need to check novelty before this filing date? Find Prior Art