A honeypot is a deliberately exposed, instrumented system designed to attract and record an attacker's behaviour. Traditional honeypots, real, widely deployed tools such as Cowrie (an SSH and Telnet honeypot) and the T-Pot platform that bundles several honeypot daemons together, are static: they respond to every connection the same scripted way regardless of who is attacking or how long the session has run. An adaptive honeypot treats each session as a small reinforcement learning episode: the agent chooses, at each step, how deeply to engage the attacker, trading off the intelligence value of keeping them talking against the growing risk that a patient attacker will notice the deception and disengage.
honeypot_qlearning.py
import numpy as np
# States: how many commands the attacker has run so far (capped at 9)
# Actions: 0 = keep session open, 1 = serve a believable fake error,
# 2 = terminate the connection
n_states, n_actions = 10, 3
Q = np.zeros((n_states, n_actions))
alpha, gamma, epsilon = 0.1, 0.9, 0.2
def reward(state: int, action: int) -> float:
# engagement gathers intel but risks the attacker noticing the ruse
if action == 0: # keep engaging
detection_risk = 0.04 * state
return 1.0 - detection_risk
if action == 1: # fake error, buys a little more time cheaply
return 0.4
return -0.2 # terminating ends the episode with no new intel
for episode in range(300):
state = 0
for _step in range(9):
if np.random.random() < epsilon:
action = np.random.randint(n_actions)
else:
action = int(np.argmax(Q[state]))
r = reward(state, action)
next_state = min(state + 1, n_states - 1) if action != 2 else state
Q[state, action] += alpha * (
r + gamma * np.max(Q[next_state]) - Q[state, action]
)
if action == 2:
break
state = next_state
epsilon = max(0.02, epsilon * 0.99)
Case study: Why Static Honeypots Eventually Get Spotted
A purely scripted honeypot answers every command the same way every time, and a patient attacker, or an automated reconnaissance tool, will eventually notice the pattern: identical response timing, identical fake file listings, identical behaviour after an unusual command. Adaptive, learning-driven engagement, deciding session by session how to respond based on what has kept past attackers engaged longest without triggering suspicion, is an active area of academic security research precisely because it directly targets this weakness. The approach trades a harder engineering problem (training and maintaining an RL agent) for a genuinely harder detection problem for the attacker, who can no longer fingerprint a single static script.