Specialized Cyber Defense & Operational Agents
Problem Statement
Deception technology relies on placing believable honey-files (e.g., fake passwords, mock financial spreadsheets) on endpoints to trap attackers. If honey-files appear generic or static, experienced threat actors recognize the trap and avoid interacting with them.
Goal
Build an AI agent that analyzes the local host file context and dynamically generates realistic, context-aware synthetic honey-files.
Outcome Measurement
- Deception Believability: High interaction rates by attackers in simulated adversary exercises.
- Zero Overhead: Instant synthetic document generation tailored to victim host metadata.
How the Code was Built
Uses domain-specific LLM text generation to craft realistic corporate document contents and file structures.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass HoneyFileSpec(BaseModel): suggested_filename: str target_directory: str file_contents: str decoy_canary_url: strdef generate_synthetic_honeyfile(host_role: str, department: str) -> HoneyFileSpec: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(HoneyFileSpec) prompt = f"Generate realistic synthetic honey-file content for host role '{host_role}' in department '{department}'." return structured_llm.invoke(prompt)if __name__ == "__main__": res = generate_synthetic_honeyfile("Senior DevOps Engineer", "Cloud Infrastructure") print(f"Filename: {res.suggested_filename}") print(f"Target Path: {res.target_directory}") print("Contents Preview:\n", res.file_contents[:150], "...")
Leave a Reply