AI-based deception and honeypot systems focus on detecting and analyzing unauthorized access attempts by using decoy services that attract and record suspicious interactions. They involve monitoring SSH login attempts, capturing command-execution activity, examining session logs, and analyzing behavioral patterns to understand potentially malicious access behavior. By combining AI-driven adaptive interaction with machine learning-based behavioral classification, this approach helps identify suspicious login patterns, characterize command-execution activity, and distinguish potentially malicious sessions from routine connection attempts. The collected interaction data supports attacker behavior profiling, threat investigation, and the refinement of detection strategies, while deception-based monitoring provides additional visibility into unauthorized access techniques without exposing production services.