A study by researchers at the Czech Technical University in Prague reveals that 99.23% of authenticated SSH sessions are non-interactive, involving automated clients that run a single command and disconnect. These sessions are primarily used for rapid reconnaissance, gathering system details like operating system version and uptime. While some scanners test for honeypots using mathematical or file-based checks, the study found no evidence of prompt-injection attacks against LLM-based honeypots.
- Automated scanners use single-command sessions for triage.
- LLM-based honeypots must be able to handle functional checks to remain effective.
- Automated scanners use single-command sessions for triage.
- LLM-based honeypots must be able to handle functional checks to remain effective.
