Search papers, labs, and topics across Lattice.
This paper introduces ShellGames, an SSH shell simulator leveraging Large Language Models (LLMs) to enhance cyber deception strategies by addressing key limitations such as persistent state and output inconsistencies. By integrating techniques like memory management, speculative command execution, and subversion detection, ShellGames significantly improves command accuracy, consistency, state tracking, and robustness compared to existing baselines. The systematic evaluation demonstrates that ShellGames not only achieves high performance metrics but also provides a realistic user experience, outperforming traditional honeypots in perceived command coverage.
ShellGames achieves a staggering 36-point boost in sequence-level consistency, setting a new standard for LLM-driven cyber deception.
Cyber deception and Moving Target Defense are promising strategies that aim to disrupt adversaries by increasing uncertainty. However, sustaining long-lived, credible interactive sessions with adversaries remains an open challenge. Large Language Models (LLMs) offer a promising path toward more dynamic deception systems, but suffer from key limitations that fundamentally limit their applicability, including: lack of persistent state, output inconsistencies, hallucinations, latency, and susceptibility to behavioral subversion that may reveal the deception. We propose ShellGames, an SSH shell simulator based on LLM designed to address these limitations. ShellGames combines five complementary techniques: (i) Automatic Chain-of-Thought and few-shot learning to improve correctness; (ii) memory management to maintain system state coherency; (iii) speculative command execution to reduce response latency; (iv) smart routing of complex interactive commands to a sandboxed environment; and (v) subversion detection leveraging the constrained input-output domain of shell environments. To enable systematic evaluation, we introduce a standardized benchmarking protocol and dataset spanning correctness, consistency, state tracking, and robustness tasks. ShellGames achieves $0.898$ command accuracy on correctness ($+5.3pp$ over baselines), $0.918$ sequence-level accuracy on consistency ($+36pp$), $0.98$ state tracking accuracy ($+18.3pp$), and $0.95$ accuracy on robustness ($+37pp$). A user study with $n=20$ participants confirms that ShellGames achieves realism comparable to a real shell under free exploration and outperforms traditional honeypots on perceived command coverage.
