Organizations use Secure Shell (SSH) to administer Linux servers, manage remote systems, and perform authorized command-line operations. Because SSH provides remote access to system resources, publicly exposed SSH services are frequently targeted by unauthorized login attempts, password guessing, and suspicious command interactions.
A conventional SSH honeypot can record login attempts, submitted usernames and passwords, session information, and commands entered by an interacting user. However, its interaction behavior depends on the honeypot's configuration and implementation. A conventional honeypot may not provide context-aware responses that adapt to the sequence of interactions within a session.
In this use case, Cowrie SSH Honeypot is deployed on an Ubuntu Linux virtual machine inside an isolated VirtualBox laboratory. Kali Linux is used as the controlled security-testing environment for generating authorized SSH login attempts and simulated command interactions.
A publicly available SSH honeypot dataset is used to study existing SSH interaction patterns and support the preparation and evaluation of representative test cases. The dataset is kept separate from the records generated during the laboratory experiments.
Llama 3.1, executed locally through Ollama, is integrated with Cowrie using a Python-based response-generation workflow. The integration supplies relevant session context to the language model and receives candidate responses for validation before they are returned through the honeypot interaction.
The implementation must connect the model to Cowrie's actual interaction-handling workflow. Installing Ollama and Llama 3.1 alone does not make Cowrie adaptive. Python integration code is required to manage the interaction context, request model responses, validate the output, and handle failures safely.
Cybersecurity tools such as Wireshark and Suricata can support network-level observation and monitoring of the controlled testing environment. Cowrie session logs remain the primary source for examining the simulated SSH interactions and evaluating the generated responses.
The final assessment determines whether the integrated honeypot can generate context-aware responses, record interaction evidence, handle invalid model outputs, and continue operating without executing model-generated commands on the underlying host.
Application/Service: Cowrie SSH Honeypot
Cowrie is an open-source SSH and Telnet honeypot designed to record and emulate interactions with a system that appears to provide remote access.
It can capture information about login attempts and user interactions, depending on its configuration and the interaction mode being used.
In this use case, Cowrie provides the SSH honeypot environment that receives controlled login attempts and records the resulting interactions.
A conventional honeypot may use predefined responses or a fixed set of emulated commands. This can limit its ability to produce context-aware responses when an interaction changes across multiple steps.
For example, an interacting user may attempt authentication, inspect the apparent system environment, enter commands, and modify their subsequent behavior according to earlier responses. A fixed response pattern may not maintain sufficient contextual continuity across these interactions.
A language model can potentially improve the interaction by generating responses based on relevant session context. However, unconstrained model output can also introduce inconsistent responses, unsupported command results, unexpected content, and integration failures.
Therefore, the challenge is to integrate language-model-generated responses without allowing model output to execute directly on the underlying Ubuntu host.
The proposed solution introduces a Python-based integration between Cowrie and Llama 3.1, using Ollama as the local model runtime. Publicly available SSH honeypot data supports the study of interaction patterns, while newly collected laboratory logs are used to evaluate the implemented workflow. Generated responses are validated before being returned, and model-generated content is never executed directly as host commands.
Specific Attack: Unauthorized SSH Login and Simulated Command-Execution Attempts Against a Cowrie SSH Honeypot
The controlled attack scenario evaluates how the adaptive SSH honeypot responds to unauthorized login attempts and subsequent command interactions.
Kali Linux is used to generate authorized test traffic against the Cowrie SSH honeypot deployed inside the isolated laboratory.
The testing includes controlled login attempts using designated test credentials and harmless command interactions intended to resemble common SSH reconnaissance behavior.
The objective is to evaluate whether Cowrie captures the interactions correctly and whether the Python-integrated Llama 3.1 workflow generates context-aware responses that remain consistent with the honeypot's intended environment.
The activity is restricted to the laboratory. No production SSH service or unauthorized external system is targeted. No generated command is executed on the underlying host.
LLM-Based Adaptive Honeypot Interaction and Context-Aware Response Generation
The primary security concept is LLM-based adaptive honeypot interaction.
The concept uses a language model to generate candidate responses based on the relevant context of a controlled SSH session. Instead of relying exclusively on fixed responses, the integration can use earlier interactions to provide context for subsequent responses.
Cowrie remains responsible for handling the honeypot interaction and collecting session evidence. Python acts as the integration layer between Cowrie and the local language model. Ollama provides the model runtime, while Llama 3.1 generates candidate responses.
The integration must validate generated output before returning it to the interacting client. Generated text must not be treated as executable instructions for the underlying Ubuntu host.
A publicly available SSH honeypot dataset provides existing interaction records for studying common patterns and preparing representative evaluation cases. The dataset does not automatically train or fine-tune Llama 3.1. Unless a separate training or fine-tuning stage is implemented, the model is used for response generation rather than being trained on the dataset.
The security concept defines the overall adaptive honeypot interaction strategy. The following are the specific defensive mechanisms implemented.
Cowrie is deployed inside an isolated laboratory to receive controlled SSH interactions without exposing the host's actual administrative shell.
A publicly available SSH honeypot dataset is reviewed to understand existing login-attempt patterns and command-interaction examples. Relevant records are used to prepare representative test cases and support response evaluation.
The Python integration extracts relevant information from the current Cowrie session, such as the interaction sequence and previous simulated commands. Only the necessary context is supplied to the language model.
Llama 3.1 generates candidate responses based on the session context supplied by the Python integration through Ollama.
The Python integration checks generated output against defined validation rules, including response format, permitted content, and unexpected output handling. Invalid or unusable responses are rejected.
Generated model output is handled as text. It is not passed to a shell, subprocess, or host command executor. Simulated command behavior remains within the honeypot's controlled interaction environment.
Cowrie and the associated testing components operate within an isolated VirtualBox laboratory. Network connectivity is restricted to the systems required for the authorized experiment.
Cowrie logs relevant session events and interactions. The Python integration records the corresponding response-generation outcomes and errors, with appropriate timestamps or session identifiers where available.
Wireshark is used to inspect observable network communication, while Suricata can monitor the test network and generate alerts for traffic matching its configured detection rules.
The integrated workflow is tested using repeated controlled interactions. Generated responses, validation failures, logs, and integration errors are reviewed against the initial baseline.
Cowrie is the primary target application in this use case. It emulates SSH interactions and records relevant session activity.
Llama 3.1 is the language model used to generate candidate responses based on the context supplied by the integration.
Ollama runs the selected Llama 3.1 model locally and provides the interface used by the Python integration to submit prompts and receive generated responses.
Python implements the integration logic connecting Cowrie's interaction workflow to Ollama. It also supports dataset inspection, log processing, response validation, and evaluation.
Kali Linux provides the controlled security-testing environment for initiating authorized SSH interactions against Cowrie.
Ubuntu Linux hosts the Cowrie SSH honeypot and the associated integration components according to the selected laboratory architecture.
Wireshark is used to capture and inspect network packets exchanged during the controlled testing.SSH application data is encrypted during normal SSH communication, so Wireshark cannot be relied upon to reveal the plaintext commands exchanged inside an encrypted session. Cowrie logs provide the primary command-interaction evidence.
Suricata is a network intrusion detection tool that can monitor the laboratory network and generate alerts when observed traffic matches configured detection rules.Its effectiveness depends on the available traffic visibility and the rules enabled. Encrypted SSH traffic limits direct inspection of the commands carried within the connection.
pandas and NumPy support the inspection and processing of publicly available SSH honeypot records and the laboratory's collected evaluation data.
VirtualBox provides the isolated virtual machines required for the laboratory.
Cowrie SSH Honeypot is deployed on Ubuntu Linux within an isolated VirtualBox laboratory to capture controlled SSH interactions.
A publicly available SSH honeypot dataset is analyzed to understand existing login-attempt patterns and prepare representative interaction test cases.
Kali Linux is used to perform controlled SSH login attempts and simulated command-interaction testing against the Cowrie honeypot
Llama 3.1 is integrated through Ollama and Python to generate context-aware candidate responses based on the current SSH session.
Python-based response validation checks generated outputs before they are returned through the honeypot interaction workflow.
Host command-execution safeguards prevent model-generated text from being executed directly on the underlying Ubuntu system.
Cowrie session logs and Python integration records provide evidence of login activity, simulated commands, generated responses, and integration errors.
Wireshark and Suricata provide supporting network-level observations and alerts for traffic matching the configured monitoring rules.
Response relevance, consistency, latency, invalid-response frequency, and error-handling behavior are evaluated using the collected laboratory records.
The complete adaptive SSH honeypot workflow is assessed through dataset analysis, controlled attack testing, LLM integration, response validation, security monitoring, and final security validation.
Research Breakthrough Possible @S-Logix