FlagThis

Abstract

Our research studies and quantifies this phenomenon of noninteractive sessions by deploying advanced LLM-based SSH honeypots on the Internet for 15 days and analyzing which attacks use interactive and non-interactive sessions and for what. Our methodology first involves developing a variant of the AdvancedShelLM LLM-based SSH honeypot [2], making it capable of distinguishing these two session types. Second, we analyze the attacks collected during the period, extracting session commands and answers. Finally, we validate our findings against an independent Honeypotas-a-Service (HaaS) Cowrie honeypot network operated by CZ.NIC over the same window [5].