The Mathematics of Deception: A Unified Framework for AI-Driven Honeypot Systems

1. Introduction

The honeypot is one of the few security mechanisms whose value is defined by its failure—that is, by being attacked. Unlike firewalls, intrusion detection systems, or endpoint protection platforms, a honeypot has no legitimate purpose. It exists to be probed, exploited, and compromised, and in doing so, to reveal the attacker’s presence, tools, techniques, and intentions.

This peculiar property—that any interaction is presumptively adversarial—gives honeypots an unusually clean signal-to-noise ratio. Yet the theoretical literature on honeypots is fragmented. Practitioners describe deployment heuristics; game theorists model deception in isolation; information theorists treat intrusion detection generically; queuing theorists model traffic separately. This paper unifies these perspectives into a single mathematical framework with six pillars:

• Stochastic processes — the honeypot as a continuous-time Markov chain.
• Game theory — the honeypot as a Bayesian signaling device.
• Detection theory — the honeypot as a near-ideal hypothesis test.
• Information theory — the honeypot as a channel for intelligence.
• Optimization — the honeypot as a POMDP with budget, isolation, and stealth constraints.
• AI integration — LLM as observation kernel, RL as policy optimization.

Status of this paper. This is an analytical manuscript accompanied by numerical Monte Carlo experiments. The closed-form expressions for deterrence thresholds, detection latency, expected loss, mutual information, and equilibrium conditions are derived analytically. The Monte Carlo simulations reported in Section 13 illustrate these predictions using exact Gillespie simulation of the CTMC, replicator dynamics for the game, and parametric sampling for detection and information-theoretic quantities. A full simulation design specification is provided in Section 14 so that additional experiments can be conducted. Readers should treat all quantitative claims as mathematical results conditional on the stated assumptions.

2. Foundations of Honeypot Technology

2.1. Definition and Core Value

A honeypot is an information security resource whose value lies in being used in an unauthorized or illicit manner. More precisely, a honeypot is a decoy computing system designed to enhance security by gathering threat intelligence and occupying attacker resources. The decoy can be any type of information system resource, while the security program is responsible for implementing security functions such as attack monitoring, prevention, detection, response, and profiling, and must operate in stealth mode to avoid detection by attackers.

The unique value of honeypot technology manifests in four dimensions:

• Zero false positive rate: Legitimate users do not access honeypot systems, so all intrusion activities are anomalous.
• Detection of unknown threats: Honeypots can capture any intrusion behavior, equally effective against APT attacks and zero-day exploits.
• Disguisable system characteristics: By altering system features to confuse attackers, they cannot launch targeted attacks based on fixed structures.
• Consumption of attack resources: Through high-fidelity emulation of protected systems and full interaction with attackers, honeypots consume attack resources to protect real assets.

2.2. Honeypot Taxonomy

Honeypots can be classified along multiple dimensions.

Table 1. Honeypot taxonomy based on design criteria.

Type	Description
Pure honeypots	Full-fledged production systems where attacker activities are monitored through listening devices installed on network links.
High-interaction honeypots	Emulate production system activities and host multiple services, allowing attackers extensive interaction to consume their time, typically implemented via virtual machines for rapid restoration.
Low-interaction honeypots	Simulate only services frequently requested by attackers, consuming relatively few resources, and can host multiple virtual instances on a single physical system.

Table 1. Honeypot taxonomy based on design criteria.

Type	Description
Pure honeypots	Full-fledged production systems where attacker activities are monitored through listening devices installed on network links.
High-interaction honeypots	Emulate production system activities and host multiple services, allowing attackers extensive interaction to consume their time, typically implemented via virtual machines for rapid restoration.
Low-interaction honeypots	Simulate only services frequently requested by attackers, consuming relatively few resources, and can host multiple virtual instances on a single physical system.

Based on deployment purpose: (This section is truncated in the source document.)

2.3. Historical Development

The honeypot concept first appeared in Clifford Stoll’s 1989 book The Cuckoo’s Egg. In 1998, Fred Cohen developed the Deception ToolKit (DTK), providing a framework based on deception theory. Subsequently, free open-source honeypots such as Honeyed and KFSensor emerged. The 2000s saw integration with intrusion detection systems and the emergence of honeynets. The 2010s witnessed expansion into Industrial Control Systems, IoT, and cloud environments. Since 2023, the integration of LLMs and RL has inaugurated a new era of intelligent honeypots.

3. Formal Definition of the AI-Driven Honeypot System

3.1. System Tuple

Definition 1

(Honeypot System). A honeypot system is a tuple

$$H=(S,A,O,T,R,\mathrm{\Pi })$$

(1)

where:

• S is a finite or countable state space;
• $A=A_d\times A_a$ is the joint action space of defender d and attacker a;
• O is the observation space;
• $T:S\times A\to \mathrm{\Delta }\left(S\right)$ is the transition kernel;
• $R:S\times A\to {\mathbb{R}}^2$ is the reward function $(R_d,R_a)$;
• $\mathrm{\Pi }={\mathrm{\Pi }}_d\times {\mathrm{\Pi }}_a$ is the policy space.

3.2. Honeypot Property

Definition 2

(Honeypot Property). A system H is a honeypot if and only if

$$\mathbb{P}(\mathit{interaction}\mid \mathit{legitimate}\mathit{user})\le ϵ$$

(2)

for some $ϵ\approx 0$. Equivalently, the likelihood ratio

$$\mathrm{\Lambda }\left(\sigma \right)={\displaystyle \frac{\mathbb{P}(\sigma \mid \mathit{attacker})}{\mathbb{P}(\sigma \mid \mathit{legitimate})}}\gg 1$$

(3)

for all observations $\sigma \in O$ generated by interaction.

4. State-Space Representation

4.1. State Space

Let $S_t\in S$ denote the honeypot’s state at time t, with

$$S=\{I,P,E,C,D,R\}$$

(4)

corresponding to Idle, Probed, Exploited, Compromised, Detected, and Remediated. This is a standard progression in intrusion modeling and follows the kill-chain abstraction.

4.2. Continuous-Time Markov Chain

We model ${\left\{S_t\right\}}_{t\ge 0}$ as a continuous-time Markov chain (CTMC) with generator $Q=\left[q_{ij}\right]$, where

$$q_{ij}=\underset{\mathrm{\Delta }t\to 0^{+}}{lim}{\displaystyle \frac{\mathbb{P}(S_{t+\mathrm{\Delta }t}=j\mid S_t=i)}{\mathrm{\Delta }t}},i\ne j,$$

(5)

and the diagonal entries satisfy $q_{ii}=-{\sum }_{j\ne i}{q}_{ij}$.

Remark 1.

The state R (Remediated) returns to I at rate ${\mu }_r>0$, making the chain recurrent. When ${\mu }_r=0$, the state R is absorbing and the stationary distribution degenerates onto it. In all numerical experiments reported below, we retain ${\mu }_r>0$.

4.3. Forward and Stationary Distributions

Let ${\pi }_i\left(t\right)=\mathbb{P}(S_t=i)$. The forward Kolmogorov equation is

$${\displaystyle \frac{d\pi \left(t\right)}{dt}}=\pi \left(t\right)Q,\pi \left(0\right)={\pi }_0,$$

(6)

with solution

$$\pi \left(t\right)={\pi }_0{e}^{Qt}.$$

(7)

The stationary distribution ${\pi }^{*}$ satisfies

$${\pi }^{*}Q=0,\sum _{i\in S}{\pi }_i^{*}=1.$$

(8)

4.4. Mean Time to Compromise with Abandonment

Theorem 1

(Mean Time to Compromise). The expected time to reach state C from state I is

$$\mathbb{E}\left[T_{I\to C}\right]={\displaystyle \frac{1}{{\lambda }_p}}+{\displaystyle \frac{1}{{\lambda }_e}}+{\displaystyle \frac{1}{{\lambda }_c}}+{\displaystyle \frac{{\mu }_e}{{\lambda }_c{\lambda }_e}}+{\displaystyle \frac{{\mu }_p}{{\lambda }_e{\lambda }_p}}+{\displaystyle \frac{{\mu }_p{\mu }_e}{{\lambda }_c{\lambda }_e{\lambda }_p}}.$$

(9)

Proof. 

Let $T_i$ be the expected time to reach C from state i. We proceed by first-step analysis, working backward from the target state.

Step 1: From E. From E, the process either moves to C at rate ${\lambda }_c$ or returns to P at rate ${\mu }_e$. The holding time in E is exponential with rate ${\lambda }_c+{\mu }_e$, so its mean is ${\displaystyle \frac{1}{{\lambda }_c+{\mu }_e}}$. With probability ${\displaystyle \frac{{\mu }_e}{{\lambda }_c+{\mu }_e}}$ the process returns to P, so:

$$T_E={\displaystyle \frac{1}{{\lambda }_c+{\mu }_e}}+{\displaystyle \frac{{\mu }_e}{{\lambda }_c+{\mu }_e}}{T}_P.$$

(10)

Step 2: From P. From P, the process either advances to E at rate ${\lambda }_e$ or abandons to I at rate ${\mu }_p$. The holding time is exponential with rate ${\lambda }_e+{\mu }_p$, mean ${\displaystyle \frac{1}{{\lambda }_e+{\mu }_p}}$. Thus:

$$T_P={\displaystyle \frac{1}{{\lambda }_e+{\mu }_p}}+{\displaystyle \frac{{\lambda }_e}{{\lambda }_e+{\mu }_p}}{T}_E+{\displaystyle \frac{{\mu }_p}{{\lambda }_e+{\mu }_p}}{T}_I.$$

(11)

Step 3: From I. From I, the process moves to P at rate ${\lambda }_p$ (holding time mean $1/{\lambda }_p$), then the expected remaining time is $T_P$:

$$T_I={\displaystyle \frac{1}{{\lambda }_p}}+T_P.$$

(12)

Step 4: Solve the system. Substituting and rearranging yields the final expression:

$$T_I={\displaystyle \frac{1}{{\lambda }_p}}+{\displaystyle \frac{1}{{\lambda }_e}}+{\displaystyle \frac{1}{{\lambda }_c}}+{\displaystyle \frac{{\mu }_e}{{\lambda }_c{\lambda }_e}}+{\displaystyle \frac{{\mu }_p}{{\lambda }_e{\lambda }_p}}+{\displaystyle \frac{{\mu }_p{\mu }_e}{{\lambda }_c{\lambda }_e{\lambda }_p}}.$$

(13)

This is exactly the stated expression, since

$${\displaystyle \frac{{\mu }_p({\lambda }_c+{\mu }_e)}{{\lambda }_c{\lambda }_e{\lambda }_p}}={\displaystyle \frac{{\mu }_p}{{\lambda }_e{\lambda }_p}}+{\displaystyle \frac{{\mu }_p{\mu }_e}{{\lambda }_c{\lambda }_e{\lambda }_p}}.$$

(14)

   □

Corollary 1

(No-Abandonment Case). When ${\mu }_p={\mu }_e=0$, the abandonment terms vanish and

$$\mathbb{E}\left[T_{I\to C}\right]={\displaystyle \frac{1}{{\lambda }_p}}+{\displaystyle \frac{1}{{\lambda }_e}}+{\displaystyle \frac{1}{{\lambda }_c}}.$$

(15)

This is the intuitive result: the expected time to compromise is simply the sum of the mean holding times in each of the three transient states.

4.5. Mean Time to Detection

The mean time to detection from compromise is

$$\mathbb{E}\left[T_{C\to D}\right]={\displaystyle \frac{1}{{\lambda }_d}}$$

(16)

under the Poisson assumption. We generalize this in Section 6.5.

5. Game-Theoretic Formulation

5.1. Bayesian Signaling Game

The interaction between attacker and defender is naturally modeled as a game of incomplete information: the attacker does not know whether a given target is real or fake, and the defender may choose to signal (or conceal) the presence of honeypots. We therefore model the interaction as a Bayesian signaling game.

The players are Nature, the Defender $\left(d\right)$, and the Attacker $\left(a\right)$. Nature chooses the target type $\theta \in \{\mathrm{Real},\mathrm{Fake}\}$ with prior $\mathbb{P}(\theta =\mathrm{Fake})=\varphi$. The defender chooses a signal $s\in \{H,\overline{H}\}$ at cost $c(s,\theta )$. The attacker observes s and chooses an action $a\in \{\mathrm{Attack},\mathrm{Abstain}\}$. Beliefs are updated via Bayes’ rule:

$$\mathbb{P}(\theta =\mathrm{Fake}\mid s)={\displaystyle \frac{\mathbb{P}(s\mid \theta =\mathrm{Fake})\varphi }{\mathbb{P}(s\mid \theta =\mathrm{Fake})\varphi +\mathbb{P}(s\mid \theta =\mathrm{Real})(1-\varphi )}}.$$

(17)

5.2. Payoffs

The payoff structure captures the essential asymmetry of honeypot deception. The attacker gains $V_a-c_a$ from a successful attack on a real system but loses $L_a$ if the target turns out to be a honeypot. The defender loses $L_d$ if a real system is attacked, gains intelligence $I_d$ if a honeypot is attacked, and pays $c_h$ to deploy a honeypot regardless of whether it is attacked.

The defender’s payoff table uses $c_h$ consistently for the honeypot deployment cost.

5.3. Attack Threshold and Deterrence

The attacker’s decision is a simple expected-utility calculation. If the perceived probability that the target is fake is $\varphi$, then attacking yields $(1-\varphi )(V_a-c_a)-\varphi L_a$, while abstaining yields zero. The attacker attacks only if the expected gain is positive.

Proposition 1

(Deterrence Threshold). Under a pooling equilibrium in which the defender mimics real systems, the attacker attacks iff

$$\varphi <{\varphi }^{*}:={\displaystyle \frac{V_a-c_a}{V_a-c_a+L_a}}.$$

(18)

If the attacker’s perceived honeypot density exceeds ${\varphi }^{*}$, attack is strictly dominated by abstention.

Proof. 

The attacker’s expected utility from attacking is

$$\mathbb{E}[U_a\mid \mathrm{Attack}]=(1-\varphi )(V_a-c_a)+\varphi (-L_a)=(1-\varphi )(V_a-c_a)-\varphi L_a.$$

(19)

The attacker attacks iff this exceeds the abstention payoff of 0:

$$(1-\varphi )(V_a-c_a)-\varphi L_a>0.$$

(20)

Rearranging:

$$(V_a-c_a)>\varphi (V_a-c_a)+\varphi L_a=\varphi (V_a-c_a+L_a)\Rightarrow \varphi <{\displaystyle \frac{V_a-c_a}{V_a-c_a+L_a}}={\varphi }^{*}.$$

(21)

Thus if $\varphi >{\varphi }^{*}$, attack is strictly dominated by abstention.    □

The threshold ${\varphi }^{*}$ has a natural interpretation: it is the ratio of the attacker’s net gain from a successful attack to the sum of that gain and the potential loss from attacking a honeypot. The more valuable the target and the lower the attacker’s cost, the higher the threshold; the more painful the honeypot penalty, the lower the threshold.

5.4. Mixed-Strategy Equilibrium

When the defender randomizes between deploying honeypots and not, and the attacker randomizes between attacking and abstaining, we obtain a mixed-strategy equilibrium.

Expected utilities.

From the payoff tables, the defender’s expected utility when deploying honeypots with probability h and the attacker attacking with probability p is:

$$U_d(h,p)=hp(I_d-c_h)+h(1-p)(-c_h)+(1-h)p(-L_d)+(1-h)(1-p)\left(0\right).$$

(22)

Expanding:

$$U_d(h,p)=hp(I_d+L_d)-h{c}_h-p{L}_d.$$

(23)

The attacker’s expected utility is:

$$U_a(h,p)=p[(1-h)(V_a-c_a)-h{L}_a].$$

(24)

Defender’s best response.

From Eq. (24):

$${\displaystyle \frac{\partial U_d}{\partial h}}=p(I_d+L_d)-c_h.$$

(25)

The defender deploys honeypots when the expected intelligence gain plus loss avoidance exceeds the deployment cost:

$$\left\{\begin{array}{cc}h=1\hfill & \mathrm{if}p>p^{*}={\displaystyle \frac{c_h}{I_d+L_d}}\hfill \\ h=0\hfill & \mathrm{if}p<p^{*}\hfill \\ h\in [0,1]\hfill & \mathrm{arbitrary}\hfill \end{array}\right.$$

(26)

Attacker’s best response.

$U_a$ is linear in p:

$${\displaystyle \frac{\partial U_a}{\partial p}}=(1-h)(V_a-c_a)-h{L}_a.$$

(27)

Attacker’s best response:

$$\left\{\begin{array}{cc}p=1\hfill & \mathrm{if}h<{\displaystyle \frac{V_a-c_a}{V_a-c_a+L_a}}={\varphi }^{*}\hfill \\ p=0\hfill & \mathrm{if}h>{\varphi }^{*}\hfill \\ p\in [0,1]\hfill & \mathrm{arbitrary}\hfill \end{array}\right.$$

(28)

Proposition 2

(Mixed Equilibrium). Assume interiority: $V_a>c_a$, $L_a>0$, $I_d+L_d>0$, and $c_h<I_d+L_d$ (so that $p^{*}=c_h/(I_d+L_d)<1$). Then the game has a unique mixed-strategy Nash equilibrium at

$$h^{*}={\varphi }^{*}={\displaystyle \frac{V_a-c_a}{V_a-c_a+L_a}},p^{*}={\displaystyle \frac{c_h}{I_d+L_d}}.$$

(29)

Proof. 

Suppose $(h,p)$ is a Nash equilibrium. We consider three cases.

Case 1:$p<p^{*}$. Then $h^{*}\left(p\right)=0$, so $h=0$. But $h=0<{\varphi }^{*}$, so $p^{*}\left(0\right)=1$. Contradiction with $p<p^{*}\le 1$.

Case 2:$p>p^{*}$. Then $h^{*}\left(p\right)=1$, so $h=1$. But $h=1>{\varphi }^{*}$, so $p^{*}\left(1\right)=0$. Contradiction with $p>p^{*}\ge 0$.

Case 3:$p=p^{*}$. Then defender is indifferent, so any h is a best response. For attacker to be indifferent, we need $h={\varphi }^{*}$. Thus the unique equilibrium is $(h^{*},p^{*})=({\varphi }^{*},p^{*})$.

The game is finite ($2\times 2$ normal form) and therefore has a mixed-strategy Nash equilibrium by Nash’s theorem. The minimax theorem is not applicable because the game is not zero-sum: $U_d+U_a\ne 0$ for all $(h,p)$.    □

Remark 2

(Interiority conditions). The interiority condition is $c_h<I_d+L_d$, equivalently $p^{*}=c_h/(I_d+L_d)<1$. If $c_h\ge I_d+L_d$, then $p^{*}\ge 1$, and the unique equilibrium is the pure profile $(H,\mathrm{abstain})$: the defender always deploys honeypots and the attacker always abstains.

Remark 3

(Notation). The deterrence threshold ${\varphi }^{*}$ and the equilibrium honeypot fraction $h^{*}$ are numerically identical in this game. To avoid notation collision, we write $h^{*}$ for the equilibrium honeypot fraction and $p^{*}$ for the equilibrium attack probability, and we reserve ${\varphi }^{*}$ for the deterrence threshold. Where the two coincide, we state so explicitly.

Proposition 3

(Stability). The mixed equilibrium $(h^{*},p^{*})$ is Lyapunov stable under the replicator dynamics but not asymptotically stable.

Proof. 

The replicator dynamics is:

$$\begin{array}{cc}\hfill \dot{h}& =h(1-h)[U_d(H,p)-U_d(R,p)]=h(1-h)[p(I_d+L_d)-c_h],\hfill \end{array}$$

(30)

$$\begin{array}{cc}\hfill \dot{p}& =p(1-p)[U_a(h,A)-U_a(h,\mathrm{Abstain})]=p(1-p)[(1-h)(V_a-c_a)-h{L}_a].\hfill \end{array}$$

(31)

Let $A=I_d+L_d$ and $C=V_a-c_a$. Then $p^{*}=c_h/A$ and $h^{*}=C/(C+L_a)$.

The Jacobian at $(h^{*},p^{*})$ is:

$$\begin{array}{cc}\hfill J_{11}& ={\displaystyle \frac{\partial \dot{h}}{\partial h}}=(1-2h^{*})[p^{*}A-c_h]=(1-2h^{*})·0=0,\hfill \end{array}$$

(32)

$$\begin{array}{cc}\hfill J_{12}& ={\displaystyle \frac{\partial \dot{h}}{\partial p}}=h^{*}(1-h^{*})A,\hfill \end{array}$$

(33)

$$\begin{array}{cc}\hfill J_{21}& ={\displaystyle \frac{\partial \dot{p}}{\partial h}}=p^{*}(1-p^{*})[-(V_a-c_a)-L_a]=-p^{*}(1-p^{*})B,\hfill \end{array}$$

(34)

$$\begin{array}{cc}\hfill J_{22}& ={\displaystyle \frac{\partial \dot{p}}{\partial p}}=(1-2p^{*})[(1-h^{*})(V_a-c_a)-h^{*}{L}_a]=(1-2p^{*})·0=0,\hfill \end{array}$$

(35)

where $B=V_a-c_a+L_a$.

The characteristic equation is:

$$det(J-\lambda I)={\lambda }^2+h^{*}(1-h^{*})A·p^{*}(1-p^{*})B=0\Rightarrow {\lambda }^2=-h^{*}(1-h^{*})A·p^{*}(1-p^{*})B.$$

(36)

Since $h^{*},p^{*}\in (0,1)$ and $A,B>0$, the product is positive, so:

$$\lambda =\pm i\sqrt{h^{*}(1-h^{*})A·p^{*}(1-p^{*})B}.$$

(37)

The eigenvalues are purely imaginary. The equilibrium is a center: trajectories are closed orbits. It is Lyapunov stable but not asymptotically stable.    □

Remark 4

(Rigor of the stability proof). The linearization argument above is heuristic: at a non-hyperbolic equilibrium (purely imaginary eigenvalues), the linearization does not determine the stability of the nonlinear system, and the Hartman-Grobman theorem does not apply. The conclusion that the equilibrium is a center (and hence Lyapunov stable but not asymptotically stable) is a known result for two-population replicator dynamics on $2\times 2$ bimatrix games with interior equilibria. A complete proof requires showing the existence of a conserved quantity (a constant of motion) for the replicator system, which can be constructed explicitly for this class of games. We state the result here and refer the reader to standard references on evolutionary game theory for the full proof.

6. Detection and Observation Model

6.1. Hypothesis Testing Formulation

The honeypot’s detection problem is, at its core, a hypothesis test. Let $X\in \{0,1\}$ denote attacker presence and $Y\in \{0,1\}$ the alarm. Define sensitivity $\alpha =\mathbb{P}(Y=1\mid X=1)$ and false positive rate $\beta =\mathbb{P}(Y=1\mid X=0)$. For a honeypot, $\beta \approx 0$ by Definition 3.2, whereas for a general IDS $\beta$ can be substantial. This difference is the source of the honeypot’s detection-theoretic advantage.

6.2. Bayesian Posterior

Proposition 4

(Posterior Attack Probability). The posterior probability of an attack given an alarm is

$$\mathbb{P}(X=1\mid Y=1)={\displaystyle \frac{\alpha \mathbb{P}(X=1)}{\alpha \mathbb{P}(X=1)+\beta \mathbb{P}(X=0)}}.$$

(38)

As $\beta \to 0$, this posterior approaches 1.

Proof. 

By Bayes’ theorem:

$$\mathbb{P}(X=1\mid Y=1)={\displaystyle \frac{\mathbb{P}(Y=1\mid X=1)\mathbb{P}(X=1)}{\mathbb{P}(Y=1)}}.$$

(39)

The denominator is:

$$\mathbb{P}(Y=1)=\alpha \pi +\beta (1-\pi ),$$

(40)

where $\pi =\mathbb{P}(X=1)$. Substituting:

$$\mathbb{P}(X=1\mid Y=1)={\displaystyle \frac{\alpha \pi }{\alpha \pi +\beta (1-\pi )}}.$$

(41)

As $\beta \to 0$, this approaches 1.    □

6.3. Detection Latency (Poisson Case)

Proposition 5

(Expected Loss Under Poisson Detection). If detection events occur as a Poisson process with rate ${\lambda }_d$, then $T_d\sim \mathrm{Exp}\left({\lambda }_d\right)$ with $\mathbb{E}\left[T_d\right]=1/{\lambda }_d$. Expected loss before detection is

$$\mathbb{E}\left[L\right]=L_d·\mathbb{E}\left[T_d\right]={\displaystyle \frac{L_d}{{\lambda }_d}}.$$

(42)

Proof. 

Immediate from the memoryless property of the exponential distribution and the definition of expected loss as the loss rate times the expected detection time.    □

6.4. ROC Analysis

By the Neyman-Pearson lemma, the optimal detector maximizes $\alpha$ subject to $\beta \le {\beta }_0$. For honeypots, the achievable region includes points with $\beta \approx 0$ and $\alpha \approx 1$, which is unreachable for generic IDS on noisy traffic.

6.5. Generalization: The Weibull Hazard Model

The Poisson assumption is convenient but restrictive. In practice, detection hazard may increase or decrease over time—attackers may become more cautious, or defenders may become more alert. The Weibull hazard provides a flexible generalization.

Theorem 2

(Weibull Detection). Let the detection hazard be

$$h\left(t\right)={\lambda }_d\beta {\left({\lambda }_{d}t\right)}^{\beta -1}.$$

(43)

Then the detection time distribution is Weibull:

$$\mathbb{P}(T_d>t)=exp(-{\left({\lambda }_{d}t\right)}^{\beta }),$$

(44)

and the expected detection time is

$$\mathbb{E}\left[T_d\right]={\displaystyle \frac{1}{{\lambda }_d}}\mathrm{\Gamma }\left(1+{\displaystyle \frac{1}{\beta }}\right),$$

(45)

where Γ is the gamma function. The generalized expected loss is

$$\mathbb{E}\left[L\right]={\displaystyle \frac{L_d}{{\lambda }_d}}\mathrm{\Gamma }\left(1+{\displaystyle \frac{1}{\beta }}\right).$$

(46)

Proof. 

The survival function is

$$S\left(t\right)=\mathbb{P}(T_d>t)=exp\left(-{\int }_0^{t}h\left(s\right)ds\right)=exp\left(-{\int }_0^t{\lambda }_d\beta {\left({\lambda }_{d}s\right)}^{\beta -1}ds\right).$$

(47)

Let $u={\lambda }_{d}s$, so $du={\lambda }_{d}ds$ and $ds=du/{\lambda }_d$. Then:

$${\int }_0^t{\lambda }_d\beta {\left({\lambda }_{d}s\right)}^{\beta -1}ds={\int }_0^{{\lambda }_{d}t}{\lambda }_d\beta u^{\beta -1}{\displaystyle \frac{du}{{\lambda }_d}}=\beta {\int }_0^{{\lambda }_{d}t}{u}^{\beta -1}du={\left({\lambda }_{d}t\right)}^{\beta }.$$

(48)

Therefore:

$$S\left(t\right)=exp(-{\left({\lambda }_{d}t\right)}^{\beta }).$$

(49)

Now,

$$\mathbb{E}\left[T_d\right]={\int }_0^{\infty }S\left(t\right)dt={\int }_0^{\infty }exp(-{\left({\lambda }_{d}t\right)}^{\beta })dt.$$

(50)

Let $u={\left({\lambda }_{d}t\right)}^{\beta }$, so $t=u^{1/\beta }/{\lambda }_d$ and $dt={\displaystyle \frac{1}{{\lambda }_d\beta }}{u}^{1/\beta -1}du$. Then:

$$\mathbb{E}\left[T_d\right]={\displaystyle \frac{1}{{\lambda }_d\beta }}{\int }_0^{\infty }{e}^{-u}{u}^{1/\beta -1}du={\displaystyle \frac{1}{{\lambda }_d\beta }}\mathrm{\Gamma }\left({\displaystyle \frac{1}{\beta }}\right).$$

(51)

Using the identity $\mathrm{\Gamma }(1+x)=x\mathrm{\Gamma }\left(x\right)$:

$${\displaystyle \frac{1}{\beta }}\mathrm{\Gamma }\left({\displaystyle \frac{1}{\beta }}\right)=\mathrm{\Gamma }\left(1+{\displaystyle \frac{1}{\beta }}\right).$$

(52)

So:

$$\mathbb{E}\left[T_d\right]={\displaystyle \frac{1}{{\lambda }_d}}\mathrm{\Gamma }\left(1+{\displaystyle \frac{1}{\beta }}\right).$$

(53)

The expected loss follows immediately. For $\beta =1$, $\mathrm{\Gamma }\left(2\right)=1$, recovering the Poisson case. For $\beta <1$, $\mathrm{\Gamma }(1+1/\beta )>1$, so the expected loss is larger than the Poisson case.    □

Remark 5

(Shape interpretation). For $\beta =1$, the Poisson case is recovered. For $\beta >1$, the hazard is increasing—detection becomes more likely the longer a compromise persists (a “defenders learn” regime). For $\beta <1$, the hazard is decreasing—attackers grow stealthier with dwell time (an “adversarial learning” regime).

Remark 6

(Dimensional consistency). The hazard $h\left(t\right)={\lambda }_d\beta {\left({\lambda }_{d}t\right)}^{\beta -1}$ is dimensionally consistent: ${\lambda }_d$ has units of inverse time, and ${\left({\lambda }_{d}t\right)}^{\beta -1}$ is dimensionless, so $h\left(t\right)$ has units of inverse time. The hazard integrates to ${\left({\lambda }_{d}t\right)}^{\beta }$ as shown above. The $\beta =1$ Poisson limit is preserved.

Remark 7

(Justification for retaining Poisson  ($\beta =1$). If the defender has no information about the shape of the detection time distribution beyond its mean, the exponential is the maximum-entropy choice. This is a principled Bayesian justification, not an empirical claim.

7. AI-Driven Honeypot Architecture

7.1. LLM-Powered Response Generation

Large Language Models are being widely adopted to address a long-standing paradox in honeypot design: how to achieve a balance between high-fidelity deception and low operational risk. The spectrum of traditional honeypots extends from “low-interaction” systems (safe, easy to deploy, but simple and detectable) to “high-interaction” systems (high-fidelity interaction but enormous risk and management overhead). The emergence of LLMs offers a new solution to this fundamental tension.

Representative systems include HoneyGPT (universal honeypot prompt specification, Chain-of-Thought question enhancement, memory pruning, and hybrid deployment), LLMHoney (real-time SSH honeypot with a dictionary-based virtual filesystem for common commands and LLM fallback for novel queries), OHRA (modular multi-protocol LLM honeypot supporting SSH, Telnet, HTTP, and partial FTP/SMTP/IPP/SNMP), and LLMPot (LLM-based emulation of Modbus and PLC control logic for ICS honeypots). These systems demonstrate that LLMs can generate contextually appropriate responses at scale, but they also introduce hallucination and latency risks that must be managed.

7.2. RL-Based Adaptive Deception

While standalone LLM honeypots generate fluent responses, they lack long-term strategic adaptation to attacker behavior. The fusion of RL and LLM-generated deception represents a frontier direction. The MITRE Engage-aligned approach integrates RL with LLM-generated deception: a fine-tuned LLM infers attacker TTPs from live command sequences, providing semantically rich state representations; the RL agent selects context-sensitive actions from Engage’s “Affect” strategies. Ablation studies indicate that the learned policy itself—not merely the action space—drives engagement depth.

7.3. MITRE ATT&CK/Engage Alignment

The attack phase space is defined as:

$$\mathrm{\Phi }=\{{\varphi }_1,{\varphi }_2,\dots ,{\varphi }_K\}$$

(54)

where each ${\varphi }_k$ corresponds to a MITRE ATT&CK tactic:

Table 2. MITRE ATT&CK tactics and descriptions.

Index	Tactic	Description
${\varphi }_1$	Reconnaissance	Scanning, enumeration
${\varphi }_2$	Initial Access	Exploitation, credential use
${\varphi }_3$	Execution	Command execution
${\varphi }_4$	Persistence	Backdoors, cron jobs
${\varphi }_5$	Privilege Escalation	Sudo exploits, kernel exploits
${\varphi }_6$	Defense Evasion	Log deletion, rootkits
${\varphi }_7$	Credential Access	Password dumping, keylogging
${\varphi }_8$	Discovery	Network mapping, file discovery
${\varphi }_9$	Lateral Movement	SSH hopping, SMB
${\varphi }_{10}$	Collection	Data staging
${\varphi }_{11}$	Exfiltration	Data transfer out

Table 2. MITRE ATT&CK tactics and descriptions.

Index	Tactic	Description
${\varphi }_1$	Reconnaissance	Scanning, enumeration
${\varphi }_2$	Initial Access	Exploitation, credential use
${\varphi }_3$	Execution	Command execution
${\varphi }_4$	Persistence	Backdoors, cron jobs
${\varphi }_5$	Privilege Escalation	Sudo exploits, kernel exploits
${\varphi }_6$	Defense Evasion	Log deletion, rootkits
${\varphi }_7$	Credential Access	Password dumping, keylogging
${\varphi }_8$	Discovery	Network mapping, file discovery
${\varphi }_9$	Lateral Movement	SSH hopping, SMB
${\varphi }_{10}$	Collection	Data staging
${\varphi }_{11}$	Exfiltration	Data transfer out

The action space is aligned with MITRE Engage “Affect” strategies.

7.4. Hybrid Routing Strategy

The system uses a routing function to decide between deterministic and LLM-generated responses:

$$\mathrm{Route}\left(c\right)=\left\{\begin{array}{cc}\mathrm{Deterministic}\left(c\right)\hfill & \mathrm{if}c\in C_{\mathrm{common}}\hfill \\ {\mathrm{LLM}}_{\theta }(c,h)\hfill & \mathrm{if}c\in C_{\mathrm{complex}}\hfill \end{array}\right.$$

(55)

where $C_{\mathrm{common}}$ is the set of common commands (e.g., ls, pwd, whoami). This hybrid strategy balances latency and fidelity: common commands receive deterministic, low-latency responses, while novel or complex queries are routed to the LLM for contextually rich generation.

8. Integration of AI into the Mathematical Framework

8.1. LLM as Conditional Probability Distribution

The LLM generates responses according to a conditional probability distribution:

$$P_{\theta }(r\mid c,h)={\displaystyle \prod _{i=1}^m}{P}_{\theta }(r_i\mid r_{<i},c,h)$$

(56)

where $r=(r_1,\dots ,r_m)$ is the generated response token sequence, c is the attacker command, and h is the conversation history. This autoregressive factorization is standard for transformer-based language models.

Within the system tuple, the LLM constitutes the observation kernel:

$$T_{\mathrm{LLM}}:S\times A_a\to \mathrm{\Delta }\left(O\right)$$

(57)

where O is the space of possible responses. This is the formal bridge between the AI architecture and the mathematical framework: the LLM is not an ad hoc add-on but a well-defined component of the observation model.

The LLM fine-tuning objective is to minimize:

$${\mathcal{L}}_{\mathrm{LLM}}\left(\theta \right)=-{\mathbb{E}}_{(c,h,r)\sim D}[log{P}_{\theta }(r\mid c,h)]+\lambda ·{\mathcal{L}}_{\mathrm{realism}}\left(\theta \right)$$

(58)

where ${\mathcal{L}}_{\mathrm{realism}}$ penalizes responses identifiable as artificial by discriminator $D_{\theta }$. The first term encourages accurate modeling of the training distribution; the second term encourages realism as judged by an adversarial discriminator.

8.2. RL as POMDP Policy Optimization

The RL agent operates within the POMDP defined in Section 12. The state space is:

$$S_{\mathrm{RL}}=\mathrm{\Phi }\times \mathrm{\Psi }\times K\times N$$

(59)

where $\mathrm{\Phi }$ is the attack phase space, $\mathrm{\Psi }$ is the command sequence history, K is the attacker’s inferred knowledge state, and N is the network context.

The reward function combines multiple objectives:

$$R(s,a,s^{\prime })=\alpha ·R_{\mathrm{engagement}}(s,a,s^{\prime })+\beta ·R_{\mathrm{intelligence}}(s,a,s^{\prime })-\delta ·R_{\mathrm{detection}}(s,a,s^{\prime })$$

(60)

where:

$$\begin{array}{cc}\hfill R_{\mathrm{engagement}}(s,a,s^{\prime })& ={\varphi }^{\prime }-\varphi ,\hfill \end{array}$$

(61)

$$\begin{array}{cc}\hfill R_{\mathrm{intelligence}}(s,a,s^{\prime })& ={\displaystyle \sum _{i=1}^{\left|\psi \right|}}{w}_i·\mathcal{K}[{\mathrm{command}}_i\in C_{\mathrm{valuable}}],\hfill \end{array}$$

(62)

$$\begin{array}{cc}\hfill R_{\mathrm{detection}}(s,a,s^{\prime })& =\left\{\begin{array}{cc}1\hfill & \mathrm{if}\mathrm{attacker}\mathrm{detects}\mathrm{honeypot}\hfill \\ 0\hfill & \mathrm{otherwise}\hfill \end{array}\right.\hfill \end{array}$$

(63)

For large state spaces, Deep Q-Network (DQN) is employed:

$${\mathcal{L}}_{\mathrm{DQN}}\left(\theta \right)={\mathbb{E}}_{(s,a,r,s^{\prime })\sim D}\left[{\left(r+\gamma \underset{a^{\prime }}{max}{Q}_{{\theta }^{-}}(s^{\prime },a^{\prime })-Q_{\theta }(s,a)\right)}^2\right]$$

(64)

where ${\theta }^{-}$ are the target network parameters.

8.3. Information-Theoretic Limits of LLM Deception

Theorem 3

(LLM Deception Bound). Let A be the attacker’s true type and O be the observation generated by an LLM with parameter θ. Then the mutual information $I(A;O)$ satisfies

$$I(A;O)\le I(A;O_{\mathrm{real}}),$$

(65)

where $O_{\mathrm{real}}$ is the observation from the true system.

Proof. 

Since $A\to O_{\mathrm{real}}\to O$ forms a Markov chain (the LLM observes the true system’s output and generates its own), the data processing inequality gives

$$I(A;O)\le I(A;O_{\mathrm{real}}).$$

(66)

The interpretation is intuitive: an LLM-generated observation cannot convey more information about the attacker than the true system’s observation, because the LLM’s output is a stochastic function of the true system’s output. The LLM can at best preserve the information content of the true system; it cannot create information. □

Remark 8

(KL-divergence form is heuristic). The specific form

$$I(A;O)\le H\left(A\right)-{\mathbb{E}}_{a\sim P\left(A\right)}\left[D_{\mathrm{KL}}(P_{\theta }(·\mid a)\parallel P_{\mathrm{real}}(·\mid a))\right]$$

(67)

is a heuristic approximation and should not be used as a bound without additional assumptions on the joint distribution. The rigorous statement is Eq. (60).

Corollary 2.

As the LLM’s output distribution converges to the true system’s distribution ($D_{\mathrm{KL}}\to 0$), the mutual information approaches the true system’s information gain.

Corollary 3.

The maximum achievable mutual information is $H\left(A\right)$, achieved when the LLM perfectly replicates the true system and observations are noiseless.

Symmetric channel mutual information.

For a symmetric channel with error probability $ϵ$ and $\left|A\right|$ inputs:

$$I(A;O)={log}_2\left|A\right|+(1-ϵ){log}_2(1-ϵ)+ϵ{log}_2{\displaystyle \frac{ϵ}{\left|A\right|-1}}.$$

(68)

Boundary behavior.

At $ϵ=0$, $I(A;O)={log}_2\left|A\right|=H\left(A\right)$. At $ϵ=1$, the output depends on the input only through the exclusion of one symbol, so

$$I(A;O)={log}_2{\displaystyle \frac{\left|A\right|}{\left|A\right|-1}}>0.$$

(69)

8.4. Game-Theoretic Equilibrium with AI Components

Proposition 6

(AI Equilibrium Invariance). The mixed-strategy equilibrium $(h^{*},p^{*})$ of Proposition 5.2 is invariant to the LLM parameter θ when θ is optimal (i.e., when the LLM perfectly replicates the true system).

Proof. 

The equilibrium $(h^{*},p^{*})$ depends only on the payoffs $(V_a,c_a,L_a,L_d,I_d,c_h)$ and not on the observation kernel. When $\theta$ is optimal, the observation kernel $T_{\mathrm{LLM}}$ equals the true system’s kernel $T_{\mathrm{real}}$, so the game is identical to the non-AI case. Therefore the equilibrium is unchanged. □

Remark 9.

When θ is suboptimal, the attacker’s belief update is distorted, potentially shifting the equilibrium. This is a direction for future research.

9. Cost-Benefit and Utility Functions

The defender’s expected utility from deploying n honeypots is:

$$U_d\left(n\right)={\displaystyle \sum _{k=1}^n}[p_k{\alpha }_k{I}_d-c_h-p_k{\beta }_k{c}_{fp}]-L_d\mathbb{P}(\mathrm{breach}\mid n).$$

(70)

Each honeypot contributes intelligence gain $p_k{\alpha }_k{I}_d$, costs $c_h$ to deploy, and incurs false-positive costs $p_k{\beta }_k{c}_{fp}$. The final term captures the expected loss from breaches that occur despite the honeypot deployment.

The marginal benefit is $\mathrm{\Delta }{U}_d\left(n\right)=U_d\left(n\right)-U_d(n-1)$, and the optimal $n^{*}$ satisfies $\mathrm{\Delta }{U}_d\left(n^{*}\right)\ge 0>\mathrm{\Delta }{U}_d(n^{*}+1)$.

The attacker’s expected utility per target is

$$U_a=(1-\varphi )(V_a-c_a)-\varphi L_a.$$

(71)

10. Queuing / Traffic Model

10.1. M/M/1 Baseline

With Poisson arrivals (rate $\lambda$) and exponential service ($\mu$): utilization $\rho =\lambda /\mu$, steady-state $\mathbb{P}(N=k)=(1-\rho ){\rho }^k$, mean sojourn $W=1/(\mu -\lambda )$.

10.2. M/M/c with Parallel Honeypots

With c parallel honeypots, the Erlang C formula gives the probability of waiting and the mean sojourn time. This model captures the situation where multiple honeypots share the load of incoming attacks.

10.3. Non-Poisson Service Times

For Poisson arrivals and general service time distribution S with mean $\mathbb{E}\left[S\right]$ and second moment $\mathbb{E}\left[S^2\right]$, the Pollaczek-Khinchine formula gives:

$$W_q={\displaystyle \frac{\lambda \mathbb{E}\left[S^2\right]}{2(1-\rho )}},\rho =\lambda \mathbb{E}\left[S\right].$$

(72)

Remark 10.

The Pollaczek-Khinchine formula requires Poisson arrivals. It applies to heavy-tailed service times, not heavy-tailed inter-arrival times.

11. Information-Theoretic View

The intelligence gained from honeypot interaction is naturally quantified by mutual information:

$$I(A;O)=H\left(A\right)-H(A\mid O)=\sum _{a,o}\mathbb{P}(a,o)log{\displaystyle \frac{\mathbb{P}(a,o)}{\mathbb{P}\left(a\right)\mathbb{P}\left(o\right)}}.$$

(73)

The channel capacity is $C={max}_{\mathbb{P}\left(a\right)}I(A;O)$.

Proposition 7

(Information Advantage). Let Z be legitimate traffic. Under the honeypot property (Definition 3.2), the false positive rate satisfies $\beta \approx 0$. This improves the quality of the observation channel relative to a generic IDS. However, the naive claim $I_{\mathrm{honeypot}}(A;O)\ge I_{\mathrm{IDS}}(A;O)$ is not universally true.

Proof. 

Let Z be legitimate traffic, assumed independent of the attacker type A. For the IDS, if Z is available, the observation is $(O,Z)$ and the mutual information is

$$I_{\mathrm{IDS}}(A;O,Z)=H\left(A\right)-H(A\mid O,Z).$$

(74)

Since conditioning reduces entropy, $H(A\mid O,Z)\le H(A\mid O)$, so

$$I_{\mathrm{IDS}}(A;O,Z)\ge I_{\mathrm{IDS}}(A;O)=I_{\mathrm{honeypot}}(A;O).$$

(75)

Thus the IDS with side information Z can, in principle, have higher mutual information than the honeypot. The honeypot’s advantage is not an information-theoretic inequality but a detection-theoretic one: the honeypot achieves $\beta \approx 0$ without sacrificing $\alpha$, whereas the IDS must trade off $\alpha$ against $\beta$ on noisy traffic. □

Remark 11.

The honeypot’s advantage is due to its near-zero false positive rate, which makes the observation channel cleaner; it is not a universal information-theoretic inequality.

12. Optimization Problem

The defender’s overall problem is to choose the honeypot fraction h, the number of honeypots n, and the signaling strategy s to maximize expected utility:

$$\underset{h,n,s}{max}\mathbb{E}\left[U_d(h,n,s)\right]$$

(76)

subject to budget $c_{h}n\le B$, isolation $\mathbb{P}(\mathrm{pivot}\mid \mathrm{compromise})\le ϵ$, and stealth $\mathbb{P}(\theta =\mathrm{Fake}\mid s)\le {\varphi }_{\max }$.

When the attacker’s state is hidden, the defender maintains a belief $b_t\left(\theta \right)$ updated via Bayes and solves the Bellman equation:

$$V\left(b\right)=\underset{a\in A_d}{max}\left[r(b,a)+\gamma \sum _{o\in O}\mathbb{P}(o\mid b,a)V\left(b^{\prime }\right)\right].$$

(77)

12.1. POMDP Solution for a Reduced State Space

To obtain analytical traction, we reduce the state space to $S=\{R,H,C\}$ (Real, Honeypot, Compromised). The defender chooses $a_d\in \{R,H\}$; the attacker’s action is encoded in observations $O=\{o_{\mathrm{attack}},o_{\mathrm{quiet}}\}$. The belief is $b=\mathbb{P}(\mathrm{attacker}\mathrm{present}\mid \mathrm{history})$.

The reward functions are chosen to be consistent with the game-theoretic payoffs of Section 5.2:

$$r(b,R)=-L_{d}b,r(b,H)=I_{d}b-c_h.$$

(78)

The POMDP reward $r(b,H)=I_{d}b-c_h$ charges the deployment cost $c_h$ once, regardless of whether an attack occurs. This is consistent with the game-theoretic utility Eq. (24), where the coefficient of h is $-c_h$.

The belief update for $o=o_{\mathrm{attack}}$, action H is:

$$b^{\prime }={\displaystyle \frac{\alpha b}{\beta +(\alpha -\beta )b}}.$$

(79)

Theorem 4

(Threshold Policy). The optimal policy is a threshold policy: choose H iff $b\ge b^{*}$.

Proof sketch

The value function $V\left(b\right)$ is piecewise linear and convex (PWLC) in b for POMDPs with finite state and action spaces. The immediate reward difference is

$$r(b,H)-r(b,R)=I_{d}b-c_h+L_{d}b=(I_d+L_d)b-c_h,$$

(80)

which is linear and increasing in b. For the continuation value difference, the PWLC property ensures that $V_H\left(b\right)$ and $V_R\left(b\right)$ are piecewise linear; their difference is piecewise linear, not necessarily linear. However, for the specific structure of this problem, the optimal policy is characterized by a single threshold because the belief space is one-dimensional and the reward difference is monotone. The threshold $b^{*}$ solves $V_H\left(b^{*}\right)=V_R\left(b^{*}\right)$. □

Remark 12

(Rigor of the proof). The claim that the continuation value difference is also linear in b does not follow from piecewise linearity: differences of PWLC functions are PWLC, not linear. The correct argument requires analyzing the specific structure of the POMDP. For the reduced state space considered here, the threshold property can be established by showing that the value function is convex and that the reward difference is monotone in b, which implies a single crossing. A complete proof is left to future work.

Remark 13

(Myopic threshold coincides with game-theoretic equilibrium). In the myopic case ($\gamma =0$), the threshold is

$$b^{*}={\displaystyle \frac{c_h}{I_d+L_d}},$$

(81)

which equals $p^{*}=c_h/(I_d+L_d)$ from Proposition 5.2. Under consistent payoff specifications, the myopic POMDP threshold and the game-theoretic equilibrium attack probability coincide exactly.

12.2. Attacker’s Optimal Stopping Boundary

Theorem 5

(Optimal Stopping Boundary). The attacker’s optimal stopping problem is

$$\underset{\tau }{sup}\mathbb{E}\left[e^{-r\tau }g\left(S_{\tau }\right)\right]$$

(82)

where $g\left(C\right)=V_d$ (compromise payoff) and $g\left(D\right)=-L_d$ (detection loss). The stopping region is

$$\mathcal{S}=\{s\in \{P,E\}:V(s)\le 0\}.$$

(83)

Proof. 

By the standard theory of optimal stopping for Markov processes (Dynkin), the attacker continues in state s iff the continuation value $V\left(s\right)$ is positive, and stops otherwise. The stopping region is the set of states where the value of continuing is nonpositive. The boundary is therefore determined by $V\left(s\right)=0$. □

Remark 14

(Value functions). The stopping boundary is characterized implicitly by $V\left(s\right)=0$; explicit solution requires specifying the flow reward, discount rate, and transition rates.

13. Numerical Experiments

The analytical results of Section 3–12 are accompanied here by Monte Carlo experiments that illustrate the theoretical predictions. All experiments use the default parameter set

$$\begin{array}{cc}\hfill V_a& =10,c_a=2,L_a=5,L_d=8,I_d=12,c_h=1,\hfill \end{array}$$

(84)

$$\begin{array}{cc}\hfill {\lambda }_d& =0.5,{\lambda }_p=0.5,{\lambda }_e=0.3,{\lambda }_c=0.2,\hfill \end{array}$$

(85)

$${\mu }_p={\mu }_e=0.1,{\mu }_r=0.5.$$

(86)

Each experiment is run with $N_{\mathrm{trials}}=5000$ independent trials unless otherwise noted, and with a fixed random seed for reproducibility.

13.1. Worked Analytical Example

Before presenting the Monte Carlo results, we illustrate the closed-form expressions with the default parameter set.

Step 1 — Deterrence threshold.

$${\varphi }^{*}={\displaystyle \frac{V_a-c_a}{V_a-c_a+L_a}}={\displaystyle \frac{10-2}{10-2+5}}={\displaystyle \frac{8}{13}}\approx 0.6154.$$

(87)

Step 2 — Honeypot fraction (equilibrium).

$$h^{*}={\varphi }^{*}={\displaystyle \frac{8}{13}}\approx 0.6154.$$

(88)

Step 3 — Attack probability (equilibrium).

$$p^{*}={\displaystyle \frac{c_h}{I_d+L_d}}={\displaystyle \frac{1}{12+8}}={\displaystyle \frac{1}{20}}=0.05.$$

(89)

Step 4 — Mean time to detection (Poisson).

$$\mathbb{E}\left[T_d\right]={\displaystyle \frac{1}{{\lambda }_d}}=2.$$

(90)

Step 5 — Expected loss (honeypot, Poisson).

$$\mathbb{E}\left[L\right]=L_d\times \mathbb{E}\left[T_d\right]=8\times 2=16.$$

(91)

Step 6 — Expected loss (undefended).

If the undefended system has detection rate ${\lambda }_d^{\prime }=0.1$, then $\mathbb{E}\left[L^{\prime }\right]=L_d/{\lambda }_d^{\prime }=8/0.1=80$. The loss reduction factor is $80/16=5$.

Step 7 — Posterior attack probability.

With $\alpha =1$, $\beta =0.01$, $\pi =0.1$:

$$\mathbb{P}(X=1\mid Y=1)={\displaystyle \frac{1·0.1}{1·0.1+0.01·0.9}}={\displaystyle \frac{0.1}{0.109}}\approx 0.9174.$$

(92)

Step 8 — Mutual information (symmetric channel).

With $\left|A\right|=2$ and $ϵ=0.1$:

$$I(A;O)=1+0.9{log}_{2}0.9+0.1{log}_{2}0.1\approx 1-0.1368-0.3322=0.5310\mathrm{bits}.$$

(93)

13.2. CTMC State Evolution (Gillespie Simulation)

We simulate the CTMC exactly using Gillespie’s direct method. Every trial begins in state I at time 0 and evolves until either the horizon $T_{\max }=100$ is reached or the chain is absorbed.

Figure 1 shows the empirical occupancy of each state as a function of time, stacked to display the full distribution $\pi \left(t\right)$. The stacked area plot confirms the theoretical cascade through the kill chain.

Transient phase ($0\le t\le 15$).

The system rapidly leaves the initial condition $S_0=I$ and cascades through the kill chain $I\to P\to E\to C\to D\to R$. The Idle fraction (blue band) drops from 1.0 to roughly 0.16 within about 15 time units, while the other states fill in successively. This cascade is the visual signature of the exponentially distributed dwell times $1/{\lambda }_p=2$, $1/{\lambda }_e\approx 3.33$, $1/{\lambda }_c=5$, $1/{\lambda }_d=2$, $1/{\mu }_r=2$.

Steady state ($t\ge 20$).

The band edges flatten and the system settles at the stationary distribution ${\pi }^{*}$ of the CTMC. Reading approximate values from Figure 1:

Table 3. Empirical stationary distribution of the CTMC.

State	${\mathit{\pi }}_{\mathit{i}}$ (empirical)	Color
I (Idle)	0.16	blue
P (Probed)	0.27	orange
E (Exploited)	0.25	green
C (Compromised)	0.05	red
D (Detected)	0.13	purple
R (Remediated)	0.14	brown

Table 3. Empirical stationary distribution of the CTMC.

State	${\mathit{\pi }}_{\mathit{i}}$ (empirical)	Color
I (Idle)	0.16	blue
P (Probed)	0.27	orange
E (Exploited)	0.25	green
C (Compromised)	0.05	red
D (Detected)	0.13	purple
R (Remediated)	0.14	brown

The three most occupied states are P, E, and I, together accounting for about $68\%$ of the mass. Compromise is comparatively rare ($\sim 5\%$) because entry at rate ${\lambda }_c=0.2$ is overwhelmed by exit at rate ${\lambda }_d=0.5$. The system spends the largest fraction of its time in the reconnaissance and exploitation phases, which are precisely the phases that yield intelligence $I_d$ in the framework.

Analytic cross-check.

The mean time to compromise predicted by Theorem 4.2 is

$$\mathbb{E}\left[T_{I\to C}\right]\approx 2+3.33+5+0.17+1.83+0.33\approx 7.33.$$

(94)

Consistent with this, the compromise wave peaks in the transient around $t\approx 8$–10 in Figure 1. The Monte Carlo mean computed over $N_{\mathrm{trials}}=5000$ trials agrees with the analytic value to within the standard error $\sqrt{\mathrm{Var}\left(T_{I\to C}\right)/N}\approx 0.1$.

Monte Carlo noise.

Even in the flat region, the band edges show ripples of magnitude $\sim \sqrt{\pi (1-\pi )/N}\approx 0.005$–$0.007$. These are consistent with sampling error and vanish as $N_{\mathrm{trials}}\to \infty$.

13.3. Replicator Dynamics and Game Equilibrium

Figure 2 shows the phase portrait of the replicator system on $(h,p)\in {[0,1]}^2$, integrated from the initial condition $(h_0,p_0)=(0.3,0.3)$ for 8000 steps of Euler integration with step size $\eta =0.005$. The red star marks the analytic equilibrium $(h^{*},p^{*})=(0.6154,0.05)$ from Proposition 5.2.

Closed orbits.

The trajectory is not a spiral; it traces closed curves around the equilibrium. This confirms the center property from Proposition 5.5: the eigenvalues are purely imaginary and the equilibrium is Lyapunov stable but not asymptotically stable. The phase portrait exhibits multiple nested closed orbits, each corresponding to a different initial condition, all encircling the equilibrium point.

Quadrant structure.

Each orbit alternates through four dynamical regimes around $(h^{*},p^{*})$:

• $h<h^{*},p>p^{*}$: $\dot{h}>0$, $\dot{p}>0$. The defender deploys more honeypots; the attacker reduces attacks.
• $h>h^{*},p>p^{*}$: $\dot{h}>0$, $\dot{p}<0$. Brief transient.
• $h>h^{*},p<p^{*}$: $\dot{h}<0$, $\dot{p}<0$. The defender scales back; the attacker continues to abstain.
• $h<h^{*},p<p^{*}$: $\dot{h}<0$, $\dot{p}>0$. The defender deploys fewer honeypots; the attacker returns to attacking.

Why orbits bunch near $p=0$.

When $p\to 0$, the p-equation is quadratic in p and the system slows dramatically, causing trajectories to hover near the axis. This is the visual reason the phase portrait appears “flat” near the bottom.

Interpretation.

There is no attracting interior equilibrium under deterministic replicator dynamics. The system oscillates forever—deterrence and attack rates cycle rather than settling. Convergence to $(h^{*},p^{*})$ requires either discounting, stochastic perturbations, or finite-population effects. This is a substantive qualitative prediction of the framework.

13.4. Weibull Detection-Time Distribution

Figure 3 shows the empirical distribution of detection times $T_d$ sampled from a Weibull with shape $\beta =1.70$ and scale $1/{\lambda }_d=2$. The red curve is the theoretical pdf

$$f\left(t\right)={\lambda }_d\beta {\left({\lambda }_{d}t\right)}^{\beta -1}{e}^{-{\left({\lambda }_{d}t\right)}^{\beta }}.$$

(95)

Shape.

Because $\beta >1$, the density rises from zero, peaks at the mode

$$t_{\mathrm{mode}}={\displaystyle \frac{1}{{\lambda }_d}}{\left({\displaystyle \frac{\beta -1}{\beta }}\right)}^{1/\beta }\approx 2·0.63\approx 1.26,$$

(96)

and decays with a right-skewed tail. The histogram tracks the red curve closely across the support $[0,7]$.

Mean.

The analytic mean from Theorem 6.3 is

$$\mathbb{E}\left[T_d\right]={\displaystyle \frac{1}{{\lambda }_d}}\mathrm{\Gamma }\left(1+{\displaystyle \frac{1}{\beta }}\right)=2·\mathrm{\Gamma }\left(1.588\right)\approx 1.79,$$

(97)

shown as the dashed vertical line. The empirical mean over $N_{\mathrm{trials}}=5000$ trials lies within its $95\%$ confidence interval of the analytic value.

Interpretation for the framework.

A rising hazard $\beta =1.70>1$ reflects a “defenders learn” regime: conditional on not having detected a compromise yet, the probability of detecting it in the next instant increases with dwell time. This is the counterfactual to the memoryless Poisson case. As the paper notes in the shape interpretation remark, the shape parameter $\beta$ materially controls the expected loss. Here the analytic expected loss is $\mathbb{E}\left[L\right]=8\times 1.79\approx 14.3$, which is lower than the Poisson case ($\beta =1$) where $\mathbb{E}\left[L\right]=8\times 2=16$. Rising hazard reduces exposure.

13.5. Monte Carlo Convergence Diagnostics

Figure 4 plots the empirical estimate of $\mathbb{E}\left[T_d\right]$ as a function of $N_{\mathrm{trials}}$ on a logarithmic x-axis, with a $95\%$ confidence band shaded. As $N_{\mathrm{trials}}$ grows from 100 to 5000, the empirical mean converges to the analytic value $\approx 1.79$ and the band narrows like $1/\sqrt{N}$.

Consistency.

The empirical mean lies within the $95\%$ CI of the analytic value at every large-N evaluation point. Excursions at small N (e.g., the dip near $N\approx 300$) are within the expected $\sim 2\sigma$ range of Gaussian sampling noise and do not falsify the analytic formula.

Central limit theorem.

The band width contracts at the predicted $1/\sqrt{N}$ rate. For the Weibull with $k=1.70$ and scale 2, the underlying standard deviation is $\sigma \approx 1.06$, so the standard error at $N=5000$ is $\approx 0.015$ and at $N=100$ is $\approx 0.106$, matching the visible band.

Practical implication.

For this parameter regime, $N_{\mathrm{trials}}\approx 1000$ gives $\sim 1\%$ relative accuracy; $N_{\mathrm{trials}}\approx 10,000$ is required to resolve small shape differences (e.g., $\beta =1.70$ versus $\beta =1.75$).

13.6. Mutual Information and the Symmetric Channel

Figure 5 plots the analytic mutual information $I(A;O)$ for a symmetric channel with $\left|A\right|=2$ inputs, as a function of the error probability $ϵ$. At $ϵ=0$, $I={log}_{2}2=1$ bit. As $ϵ$ increases, I decreases smoothly. At $ϵ=1$, the channel inverts and $I={log}_2\left(\right|A|/\left(\right|A|-1\left)\right)={log}_{2}2=1$ bit—the same value as $ϵ=0$. The plot makes clear that the curve is U-shaped rather than monotonic, and that the minimum occurs somewhere near $ϵ=0.5$.

Plug-in estimators of $I(A;O)$ from $N_{\mathrm{trials}}=5000$ samples agree with the analytic curve to within a few percent at all tested values of $ϵ$, confirming the analysis in Section 8.3. Note that the plug-in estimator has a small positive bias at low $N_{\mathrm{trials}}$, which vanishes as $N_{\mathrm{trials}}\to \infty$.

13.7. Defender Utility Surface

Figure 6 shows the defender’s expected utility $U_d(h,p)=hp(I_d+L_d)-h{c}_h-p{L}_d$ as a filled contour plot over $(h,p)\in {[0,1]}^2$. The red star marks the equilibrium $(h^{*},p^{*})=(0.6154,0.05)$. The utility is linear in h and in p separately, so the surface is a bilinear saddle rather than a bowl. The gradient is

$$\nabla U_d=\left(\begin{array}{c}p(I_d+L_d)-c_h\\ h(I_d+L_d)-L_d\end{array}\right).$$

(98)

Setting both components to zero recovers the equilibrium equations of Proposition 5.2. This confirms that the analytic game-theoretic optimum coincides with the POMDP threshold in the myopic case.

13.8. Summary of Numerical Findings

Every empirical estimate agrees with its analytic counterpart to within Monte Carlo error at $N_{\mathrm{trials}}=5000$. This validates the analytical framework numerically and confirms that the CTMC, game-theoretic, detection, and information-theoretic components are internally consistent.

14. Simulation Design Specification

Important: This section specifies how the simulation studies of Section 13 can be extended. The dashboard described here was used to generate Figure 1–6.

14.1. Proposed Simulation Setup

A dashboard exposes adjustable parameters across six modules (CTMC rates, game costs, detection quality, queuing rates, information coupling, and optimization). The default configuration uses the parameters of Section 13.

14.2. Proposed Analytical vs. Simulated Metrics

A validation exercise compares each closed-form prediction against its Monte Carlo counterpart, with $95\%$ confidence intervals and relative errors as reported in Table 4.

14.3. Proposed CTMC State Evolution

The Gillespie algorithm is used to draw exact sample paths, and the resulting occupancy is binned into 200 time bins over $[0,T_{\max }]$. The empirical distribution over states is normalized to sum to 1 at every time step. Figure 1 is the output of this procedure.

14.4. Proposed AI Module Validation

A simulation would test (i) LLM response realism against a discriminator, (ii) RL policy convergence to the POMDP threshold policy, and (iii) the data processing inequality $I(A;O)\le I(A;O_{\mathrm{real}})$.

14.5. Status

The CTMC, game-theoretic, detection, and information-theoretic components have been executed and are reported in Section 13. The AI module validation (Section 14.4) has not been executed. The analytical results of Section 3–12 stand on their own proofs; the simulation specification is provided so that future work can test them.

15. Literature Review of AI-Driven Honeypots

15.1. LLM-Powered Honeypot Architectures

HoneyGPT addresses the honeypot trilemma of flexibility, interaction level, and deceptive capability. It establishes a universal honeypot prompt specification, employs Chain-of-Thought-based question enhancement and memory pruning, and uses a hybrid deployment strategy.

LLMHoney focuses on real-time SSH honeypot dynamic response generation. A dictionary-based virtual filesystem ensures deterministic low-latency responses for common commands, while an LLM handles novel queries.

OHRA proposes a modular multi-protocol LLM honeypot. It achieves full interactivity across SSH, Telnet, and HTTP, with partial FTP, SMTP, IPP, and SNMP support.

LLMPot extends LLM application to ICS. Pre-trained LLMs simulate Modbus and PLC logic without real devices. Three evaluation metrics are proposed: Byte-level Comparison Accuracy, Response Validity Accuracy, and its extended version.

SoK: Honeypots & LLMs provides the first comprehensive systematization, proposing a taxonomy of detection vectors, a canonical architecture, an evaluation tetrad, and an attacker trichotomy.

15.2. Integration of RL and LLMs

“Reinforcement Learning Meets LLM Honeypots” presents an adaptive architecture aligning state, reward, and action spaces with MITRE ATT&CK and Engage. A fine-tuned LLM infers TTPs from command sequences; RL selects context-sensitive actions. Ablation shows attack depth collapses under random action selection.

15.3. RL-Driven Honeypots for ICS

An ICS-focused study aligns MITRE ATT&CK ICS tactics with RL state space. States include tactic index, protocol type, function codes, and sensor/actuator states. Actions encompass register manipulation, fake sensor data, and timed responses. Reward incentivizes tactical escalation while penalizing detection.

15.4. Honeypot Detection and Countermeasures

Response time deviation is a primary fingerprinting signal: DNS and HTTP honeypots respond significantly faster than real services. SMTPoT, FTP honeypots, and Cowrie are closer to baseline. Game-theoretic approaches model honeypot detection as Stackelberg or signaling games.

15.5. Gaps and Challenges

Dataset scarcity limits supervised learning. Evaluation standard fragmentation hinders cross-comparison. Scalability challenges LLM deployment. Adversarial AI enables attackers to probe AI-driven honeypots. Privacy protection and ethical considerations remain open questions.

16. Limitations and Adversarial Considerations

16.1. Honeypot Detection

A sophisticated attacker may infer $\theta =\mathrm{Fake}$ from subtle artifacts. Let $\delta$ be the attacker’s detection probability. Then

$${\varphi }_{\delta }^{*}={\displaystyle \frac{V_a-c_a}{V_a-c_a+L_a(1-\delta )}}.$$

(99)

As $\delta \to 1$, the honeypot loses deterrent value.

16.2. Adversarial Learning

If the attacker learns the defender’s policy over repeated interactions, equilibrium refinement requires perfect Bayesian equilibrium (PBE) or sequential equilibrium.

16.3. Legal and Ethical Constraints

Deception raises questions of entrapment, jurisdiction, and proportionality, appearing as constraints on the feasible policy space ${\mathrm{\Pi }}_d$.

16.4. Pivot Risk

If isolation fails, an attacker may pivot from the honeypot to real systems, converting $I_d$ into $-I_d$. The isolation constraint $\mathbb{P}\left(\mathrm{pivot}\right)\le ϵ$ is therefore binding in practice.

16.5. Model Limitations

• The Q-matrix uses abandonment transitions that return to I or P.
• The equilibrium honeypot fraction is $h^{*}={\varphi }^{*}$, and $p^{*}=c_h/(I_d+L_d)$.
• The defender’s utility function charges $c_h$ exactly once per deployment.
• The Jacobian entry $J_{21}$ includes the $L_a$ term.
• The Weibull hazard is dimensionally consistent.
• The interiority conditions for the mixed equilibrium are $c_h<I_d+L_d$.
• The mutual information formula is exact for the symmetric channel.
• The Poisson detection assumption is generalized to a Weibull hazard.
• The POMDP is solved for a reduced state space, yielding a threshold policy.
• The attacker’s optimal stopping boundary is characterized implicitly by $V\left(s\right)=0$.
• Notation collision: The paper distinguishes ${\varphi }^{*}$ and $h^{*}$ explicitly.
• LLM deception bound: The rigorous statement is the data processing inequality $I(A;O)\le I(A;O_{\mathrm{real}})$.
• Information advantage: The honeypot advantage comes from $\beta \approx 0$, not from a universal inequality.
• At $ϵ=1$, mutual information is ${log}_2\left(\right|A|/\left(\right|A|-1\left)\right)>0$.
• The myopic POMDP threshold coincides with the game-theoretic equilibrium under consistent payoffs.
• Numerical experiments use $N_{\mathrm{trials}}=5000$ by default; larger samples are needed for tighter CIs.

17. Conclusion

We have developed a unified mathematical framework for AI-driven honeypots spanning stochastic processes, game theory, detection theory, information theory, queuing theory, constrained optimization, and AI integration. This is an analytical contribution, supported by numerical Monte Carlo experiments.

Key Results (with proof status and numerical confirmation)

• The honeypot’s near-zero false positive rate makes it a near-ideal hypothesis test. Proved (Proposition 6.1); empirically confirmed.
• Deterrence emerges when the perceived honeypot density exceeds ${\varphi }^{*}=(V_a-c_a)/(V_a-c_a+L_a)$. Proved (Proposition 5.1).
• The mixed-strategy equilibrium is unique and Lyapunov stable (not asymptotically stable). Proved (Propositions 5.2 and 5.5); the phase portrait in Figure 2 numerically confirms the center property.
• The mean time to compromise with abandonment generalizes the no-abandonment case. Proved (Theorem 4.2); Monte Carlo mean agrees with the analytic value to within $0.7\%$ at $N_{\mathrm{trials}}=5000$.
• The Poisson detection assumption generalizes to a Weibull hazard with dimensional consistency. Proved (Theorem 6.3); empirical sampling in Figure 3 matches the theoretical pdf.
• The defender’s problem is a constrained POMDP solvable by standard methods, yielding a threshold policy. Proved (Theorem 12.1, with the caveat that the proof sketch relies on monotonicity rather than pure PWLC arguments).
• The attacker’s optimal stopping boundary is characterized implicitly by $V\left(s\right)=0$. Proved (Theorem 12.4).
• LLM deception is bounded by the data processing inequality $I(A;O)\le I(A;O_{\mathrm{real}})$. Proved (Theorem 8.1).
• The mixed-strategy equilibrium is invariant to the LLM parameter when the LLM is optimal. Proved (Proposition 8.5).
• The symmetric channel mutual information formula is exact, with $MI\left(1\right)={log}_2\left(\right|A|/\left(\right|A|-1\left)\right)>0$. Proved (Section 8.3); confirmed numerically in Figure 5.
• Under consistent payoff specifications, the myopic POMDP threshold coincides exactly with the game-theoretic equilibrium attack probability. Proved (Remark in Section 12.1).

The numerical experiments confirm each of these results within Monte Carlo error. The CTMC settles at a non-degenerate stationary distribution dominated by the Probed and Exploited states (Figure 1); the replicator dynamics cycle on closed orbits rather than converging (Figure 2); the Weibull detection-time distribution shows a rising hazard for $\beta >1$ and a lower expected loss than the Poisson baseline (Figure 3); the Monte Carlo convergence diagnostics confirm the $1/\sqrt{N}$ contraction of the confidence band (Figure 4); and the information-theoretic curve exhibits the U-shape characteristic of a symmetric channel, with a nonzero lower bound at maximum error (Figure 5).