ABSTRACT Traditional low‐interaction honeypots are easily exposed in complex adversarial scenarios due to static responses and limited semantic understanding. To address the limitations of existing LLM‐based honeypots in protocol adaptability, long‐context maintenance, and resource efficiency, this paper proposes P‐honeypot, a low‐interaction intelligent SSH honeypot based on retrieval‐augmented generation and lightweight fine‐tuning. By combining session‐level attack semantic modeling, dual‐knowledge retrieval, and the ReAct mechanism, P‐honeypot improves multi‐turn interaction consistency while reducing hallucinations. Experimental results show that it outperforms baseline systems in interaction realism, semantic consistency, and resistance to detection.
Wu et al. (Mon,) studied this question.