AI-Adaptive Cyber Honeypot: A Dynamic Intelligent Framework for Real-Time Threat Detection and Deception

The rapid evolution of cyber threats has rendered traditional static security mechanisms insufficient against sophis- ticated and adaptive attacks. Conventional intrusion detection systems and honeypots lack the intelligence to dynamically respond to evolving attacker behavior, resulting in reduced effectiveness in real-world environments. This paper presents an AI-Adaptive Cyber Honeypot, an intelligent and dynamic cybersecurity framework that integrates machine learning, rule- based detection, and large language models (LLMs) to provide real-time threat detection and deception. The proposed system employs a hybrid detection mechanism combining rule-based filtering and AI-driven classification us- ing the Phi-3.5 mini model to distinguish between legitimate and malicious traffic. Suspicious requests are redirected to an adaptive honeypot environment that generates dynamic, context- aware responses to engage attackers, thereby preventing access to real systems while simultaneously collecting valuable threat intelligence. The system logs attacker behavior, including request patterns, IP addresses, and payload data, which are further uti- lized for continuous model retraining and system improvement. Experimental evaluation demonstrates that the system effec- tively isolates malicious actors, enhances engagement duration within the honeypot, and improves detection accuracy compared to traditional approaches. The integration of AI-driven deception and adaptive learning enables proactive defense mechanisms, making the system highly suitable for modern cybersecurity infrastructures.