Khalil Ammar

Academic & Personal Threat Intelligence Research

LLM-Powered Adaptive Honeypot

Built a deception platform as a layered pipeline: Cowrie/FastAPI collect attacker input, a policy-gated LLM generates realistic responses, and Wazuh ingests normalized telemetry. The key value was not only trapping attackers longer, but learning how to turn noisy interaction logs into structured intelligence we could act on.

Role
Sole Architect & Security Engineer
Timeline
6 Weeks
Initialize Stream

Architecture

The platform consists of containerized honeypot services (Cowrie, custom FastAPI endpoints) that forward raw attacker input to a centralized Python orchestration layer. This layer performs policy-based filtering and prompts an LLM via API to generate context-aware SSH/HTTP responses. Telemetry is normalized and ingested into a Wazuh SIEM for real-time analysis.

Implementation

Implementation involved developing custom Cowrie handlers to intercept and relay terminal input, building a high-performance orchestration layer to manage LLM latency, and configuring fine-grained Wazuh decoders for non-standard honeypot logs.

Outcome

Provides a scalable architecture for AI-assisted deception, demonstrating improved attacker dwell time and systematic ingestion of structured threat intelligence into security operations.

What it does

  • Dynamic LLM-driven SSH and HTTP interaction modules
  • Policy-guided output sanitization and model gating
  • Centralized event normalization and Wazuh SIEM integration
  • Automated IoC extraction from adversarial sessions

Technical notes

🕸️ Project GhostNet: Cognitive LLM-Powered Deception

GhostNet is an advanced, high-fidelity deception platform that uses Groq-accelerated LLMs (Moonshot Kimi-k2) to hallucinate realistic, stateful attack surfaces in real-time. It traps attackers in an infinite, semi-autonomous maze while streaming full telemetry to a centralized Wazuh SIEM.

🚀 Quick Start

  1. Clone the repository

    bash
    git clone https://github.com/khalilammarr/LLM_Honeypot.git
cd GhostNet

  2. Configure Environment Copy the example environment file and add your Groq API key:

    bash
    cp .env.example .env
# Edit .env and add API_KEY

  3. Deploy with Docker

    bash
    docker compose up -d --build

🛠️ Core Capabilities

  • Cognitive SSH (Cowrie + Groq): Fully interactive Bash shell that hallucinates file systems, scripts, and logs in real-time.
  • Dynamic HTTP (FastAPI): Adaptive web portal that generates realistic configuration files, database dumps, and API responses.
  • Zero-Leaking Deception: Custom Python filters strip model-specific reasoning tags, ensuring the attacker only sees raw terminal output.
  • SIEM Integration: Native integration with Wazuh for real-time alerting and threat analysis.

📁 Repository Structure

  • configs/: Global honeypot behavior and protocol definitions.
  • honeypot/: Core service source code (HTTP/Agent).
  • infra/: SIEM and monitoring configuration (Wazuh/Grafana).
  • docs/: Detailed architectural reports and PDF technical specifications.

⚠️ Safety Notice

[!CAUTION] This is an active deception lab. Do not host these services un-sandboxed on the public internet. Observe traffic in Host-Only or strictly firewalled environments.