Phase-adaptive Model Routing in LLM-driven SSH Honeypots: A Systematic Mapping Review

Abstract

Large Language Model (LLM)-driven Secure Shell (SSH) honeypots have rapidly displaced static, templated decoys, yet they share a structural limitation: a single model and a single policy serve every turn of an intrusion, from low-stakes reconnaissance to high-value persistence. This review asks whether honeypots can instead adapt their inference to the attacker’s phase. We conduct a Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020-guided systematic mapping review of fifty influential studies (2020–2026) drawn from three strands—honeypots and generative deception, cost-aware model routing and mixture-of-experts inference, and LLM agents, embeddings, and retrieval-augmented generation in security operations—assembled under a disclosed, purposive top-50 prioritization ranked by age-normalized citation velocity. That prioritization is a deliberate mapping strategy: it surfaces the field’s most influential work rather than claiming exhaustive coverage, and a sensitivity analysis tests how robust the conclusions are to the cap. Three findings emerge. Across the reviewed literature, honeypot adaptivity has advanced at the policy and generation layers but not at the inference-allocation layer; the routing literature has solved capacity allocation but conditions only on query-intrinsic signals, not on adversarial session phase; and embedding-based analytics, corroborated by a production deployment, show the phase signal is observable and reliable. The strands are individually mature and mutually disconnected. We formalize this gap and propose a phase-adaptive, agent-oriented framework that pairs an embedding-based phase estimator and an O(1) phase-to-model dispatch layer with an unprivileged, campaign-level observation substrate.The review contributes a reproducible corpus, an age-normalized bibliometric ranking, a formal gap analysis, and a conceptual architecture that operationalizes the maturation arc from static to phase-adaptive honeypots.

More by Bagdat Yagaliyeva

• Models and Algorithms for the Comprehensive Assessment and Forecasting of Environmental Conditions, Using the Example of Carbon Monoxide Air Pollution and Noise Pollution Associated with Road Traffic in CitiesAlgorithms · 2026
• A Benchmark and Cross-Camera Protocol for Open-Set Re-Identification of Holstein Cattle: Synchronized Multi-View Capture and Viewpoint-Invariant AlignmentAlgorithms · 2026
• Multi-criteria optimization for selecting an information security system for a university's distributed computing network based on NSGA-IIIArray · 2026 · Citations: 1
• Simulation of automated carbon quota trading based on blockchain technologyProceedings of Southwest State University · 2026