A honeypot that never changes gets fingerprinted quickly. The Autonomous Cyber Deception Grid is my design for a multi-level deception system that starts as a set of static decoys and grows into an environment that adapts to the attacker in front of it, so defenders learn more and the attacker wastes more time.
Code: github.com/Willey2003/cyber-deception-grid
Four levels
Level 1: Static deception. Containerised mock services (SSH, HTTP and a MySQL-style database) that log the attacker’s source address, timestamps and every command they type.
Level 2: Behavioural adaptation. A local LLM generates believable command output, fake files and system errors, tailored to the attacker’s technique, so the decoy holds up beyond the first few commands.
Level 3: Autonomous landscape evolution. A reinforcement learning controller changes the fake network topology, moves high-value decoys, and expands the network footprint around aggressive actors.
Level 4: Threat intelligence. Captured payloads go to a malware sandbox, observed behaviour is mapped to MITRE ATT&CK, and the results feed a central dashboard.
Services
| Service | Port | Role |
|---|---|---|
| ssh-honeypot | 2222 | Fake SSH server |
| http-honeypot | 8080 | Fake web server |
| db-honeypot | 3306 | Fake MySQL database |
| deception-api | 8000 | Orchestration API |
| llm-adapter | 8001 | Response generation |
| rl-controller | 8002 | Topology controller |
| intel-processor | 8003 | Threat intelligence |
| dashboard | 3000 | Web dashboard |
What is built so far
Level 1 is the starting point. The SSH honeypot is written in Python with Paramiko and asyncio: it accepts password logins, records each credential pair and command in an attacker session, and hands the session to an orchestrator that later levels will use to decide how the environment responds. A CI workflow runs on every push.
Design principles
- Containment first. Decoys run in isolated containers with no route to real systems. A honeypot that becomes a pivot point is worse than none.
- Local models only. Attacker input never goes to a hosted AI service, and the model only ever generates fake output.
- Everything maps to ATT&CK, so what the grid learns is usable by the SOC and not just interesting.
Next steps
HTTP and database decoys, the LLM adapter for Level 2, and a dashboard that shows live sessions and ATT&CK techniques. Run honeypots only on networks you own or are authorised to use, and keep them isolated from production.
