Decoding Galah: An LLM-Powered Web Honeypot
Presents Galah, an LLM-powered web honeypot that dynamically generates authentic HTTP responses to emulate diverse web applications.
Summary
Limitations of Low Interaction Web Honeypots
Traditional low-interaction honeypots rely on static templates to emulate web services, allowing automated scanners and attackers to detect honeypot signatures quickly.
Introducing the Galah LLM Honeypot
Galah utilizes large language models to generate dynamic, context-aware HTTP response headers and bodies in response to incoming attacker requests from a single prompt.
Benchmarking LLMs for HTTP Response Generation
Evaluating multiple language models determines their speed, fidelity, and reliability in generating authentic server responses that mimic diverse web applications.
Attacker Engagement Dynamics
Deploying Galah on the public Internet reveals how realistic, LLM-generated HTTP responses significantly increase attacker dwell time and capture novel payload interactions.
Related talks
Creator Stage·55 min
E Tahoun · L Hamida
Demonstrates how open-source data science models cluster heterogeneous security alerts to uncover coordinated multi-stage cyber attacks.
Main Stage·22 min
Alexander Rubin · Martin Rakhmanov
Active deception MySQL honeypot exploiting client-side vulnerabilities (CVE-2023-21980) to drop shells on connecting attackers.
Blue Team Village·25 min
Wendy Edwards
Wendy Edwards separates hype from reality in security AI, analyzing where machine learning excels in anomaly detection and where it fundamentally fails.