AURA: Agent-based unified response architecture for retrieval-augmented cyber deception

Anıl Sezgin

doi:10.61112/jiens.1856246

AURA: Agent-based unified response architecture for retrieval-augmented cyber deception

Abstract

The accelerated development of large language models (LLMs) has redefined the security defense landscape by providing the means to implement adaptive deception systems that can be contextually aware of the environment in which the deception must be implemented. In this paper, the authors propose a multi-agent honeypot system, AURA, which incorporates a new form of deception using a Retrieval-Augmented Generation (RAG) model to mimic command-line interfaces in an adversarial environment. A dataset of 1,500 command-response pairs, implemented using a Linux environment, was used to test the effectiveness of the model, which was evaluated over 10 different experimental configurations. The results of the experiment show a marked improvement in the effectiveness of the model, which was augmented using the RAG model, over the traditional model used as a baseline. The BLEU score was raised from 0.1455 to 0.4621, the ROUGE-L (F1) score was raised from 0.2665 to 0.5740, the METEOR score was raised from 0.2441 to 0.5282, and the Jaccard similarity was raised from 0.2244 to 0.5189, which represent an increase of over 100% in the effectiveness of the model over the traditional model used as a baseline. In the experiment, all agents of the AURA honeypot system used the Llama 3.1 8B model as the reasoning engine, which shows the effectiveness of the model in providing a secure means of implementing autonomous deception systems using a multi-agent architecture, which can be used to implement next-generation autonomous honeypots.

Keywords

References

Amal MR, Venkadesh P (2023) H-DOCTOR: Honeypot based firewall tuning for attack prevention. Measurement: Sensors 25:1–7. https://doi.org/10.1016/j.measen.2022.100664
Alani MM (2024) HoneyTwin: Securing smart cities with machine learning-enabled SDN edge and cloud-based honeypots. J Parallel Distrib Comput 188:1–9. https://doi.org/10.1016/j.jpdc.2024.104866
Lanz S, Pignol SL, Schmitt P, Wang H, Papaioannou M, Choudhary G, Dragoni N (2025) Optimizing Internet of Things honeypots with machine learning: A review. Appl Sci 15:1–30. https://doi.org/10.3390/app15105251
Sezgin A, Boyacı A (2025) DecoyPot: A large language model-driven web API honeypot for realistic attacker engagement. Comput Secur 154:1–9. https://doi.org/10.1016/j.cose.2025.104458
Yang G, Sun Z, Wang Y (2025) ShellBox: Adversarially enhanced LLM-interactive honeypot framework. IEEE Access 13:143618–143630. https://doi.org/10.1109/ACCESS.2025.3598779
Morić Z, Dakić V, Regvart D (2025) Advancing cybersecurity with honeypots and deception strategies. Informatics 12:1–37. https://doi.org/10.3390/informatics12010014
Yang X, Yuan J, Yang H, Kong Y, Zhang H, Zhao J (2023) A highly interactive honeypot-based approach to network threat management. Future Internet 15:1–31. https://doi.org/10.3390/fi15040127
Visalom R, Mihăilescu M, Rughiniș R, Țurcanu D (2025) Intercepting and monitoring potentially malicious payloads with web honeypots. Future Internet 17:1–32. https://doi.org/10.3390/fi17090422

Sarang AD, Alawami MA, Park K (2024) MV-Honeypot: Security threat analysis by deploying avatar as a honeypot in COTS metaverse platforms. CMES Comput Model Eng Sci 141(1):655–669. https://doi.org/10.32604/cmes.2024.053434
AlQahtan N, AlOlayan A, AlAjaji A, Almaslukh A (2025) HoneyLite: A lightweight honeypot security solution for SMEs. Sensors 25:1–17. https://doi.org/10.3390/s25165207
Heluany JB (2024) PLC honeypots: Enhancing interaction-level assessment. Electronics 13:1–18. https://doi.org/10.3390/electronics13204024
Rocha A, Pereira FSF (2025) What is the most targeted database? Using honeypots to characterize attacks on relational databases. Procedia Comput Sci 256:114–121. https://doi.org/10.1016/j.procs.2025.02.103
Javadpour A, Ja’fari F, Taleb T, Shojafar M, Benzaïd C (2024) A comprehensive survey on cyber deception techniques to improve honeypot performance. Comput Secur 140:1–39. https://doi.org/10.1016/j.cose.2024.103792
Li D, Tian S, Jin W, Peng J, Duan M (2025) Towards a moving target defense based on stochastic games and honeypots. Inf Sci 720:1–25. https://doi.org/10.1016/j.ins.2025.122488
Yu X, He L, Geng J, Liang Z, Gan Z, Zhao H (2025) Dynamic defense strategy selection through reinforcement learning in heterogeneous redundancy systems for critical data protection. Appl Sci 15:1–20. https://doi.org/10.3390/app15169111
d’Ambrosio N, Lista C, Perrone G, Romano SP (2025) SMASH: An SDN-MTD framework for efficient honeypot deployment and insider threat mitigation. Comput Netw 269:1–29. https://doi.org/10.1016/j.comnet.2025.111327
Chen Q, Liu Y, Tan R, Jin Z, Xiao J, Wang X, Zhang F, Liu Q (2025) Shadowkube: Enhancing Kubernetes security with behavioral monitoring and honeypot integration. Cybersecurity 8:1–19. https://doi.org/10.1186/s42400-025-00372-7
Miao S, Li Y, Pan Q (2023) Honeypot game theory against DoS attack in UAV cyber. Comput Mater Continua 76(3):2745–2762. https://doi.org/10.32604/cmc.2023.037257
Rabah MAO, Drid H, Medjadba Y, Rahouti M (2024) Detection and mitigation of distributed denial of service attacks using ensemble learning and honeypots in a novel SDN-UAV network architecture. IEEE Access 12:128929–128940. https://doi.org/10.1109/ACCESS.2024.3443142
Omar AHE, Soubra H, Moulla DK, Abran A (2024) An innovative honeypot architecture for detecting and mitigating hardware trojans in IoT devices. IoT 5:730–755. https://doi.org/10.3390/iot5040033
Al Abdulwahid A (2025) AI-driven identification of attack precursors: A machine learning approach to predictive cybersecurity. Comput Mater Continua 85(1):1751–1777. https://doi.org/10.32604/cmc.2025.066892
Yigit Y, Ferrag MA, Ghanem MC, Sarker IH, Maglaras LA, Chrysoulas C, Moradpoor N, Tihanyi N, Janicke H (2025) Generative AI and LLMs for critical infrastructure protection: Evaluation benchmarks, agentic AI, challenges, and opportunities. Sensors 25:1–40. https://doi.org/10.3390/s25061666
Wu Q, Wen S, Li F, Liu B, Zhong W (2024) Web attack detection based on honeypots and logistic regression algorithm. J Electr Syst 20(3):814–822. https://doi.org/10.52783/jes.3013
Naeini SRG, Shameli-Sendi A, Jabbarifar M (2025) Protecting industrial control systems from Shodan exploitation through advanced traffic analysis. IEEE Access 13:45985–45997. https://doi.org/10.1109/ACCESS.2025.3544906
Alatawi E, Albalawi U (2025) Harnessing AI for cyber defense: Honeypot-driven intrusion detection systems. Symmetry 17:1–15. https://doi.org/10.3390/sym17050628
Guo W, Xue J, Lin Y, Du W, Hu J, Shi N, Han W (2025) MalFSLDF: A few-shot learning-based malware family detection framework. Int J Intell Syst 2025(1):1–20. https://doi.org/10.1155/int/7390905
Agbedanu PR, Yang SJ, Musabe R, Gatare I, Rwigema J (2025) A scalable approach to IoT and IIoT security: Evaluating adaptive self-adjusting memory KNN for zero-day attack detection. Sensors 25:1–35. https://doi.org/10.3390/s25010216
Abdelmaguid MA, Hussanein HS, Zulkernine M (2025) Securing the unforeseen: Enhancing VANET security with dynamic honeypots and attack rate analysis. Veh Commun 55:1–10. https://doi.org/10.1016/j.vehcom.2025.100946
Spyros A, Koritsas I, Papoutsis A, Panagiotou P, Chatzakou D, Kavallieros D, Tsikrika T, Vrochidis S, Kompatsiaris I (2025) AI-based holistic framework for cyber threat intelligence management. IEEE Access 13:20820–20846. https://doi.org/10.1109/ACCESS.2025.3533084
Sahraoui Y, Hadjkouider AM, Kerrache CA, Calafate CT (2025) TwinFedPot: Honeypot intelligence distillation into digital twin for persistent smart traffic security. Sensors 25:1–16. https://doi.org/10.3390/s25154725
Albaseer A, Abdi N, Abdallah M, Qarage M, Al-Kuwari S (2024) FedPot: A quality-aware collaborative and incentivized honeypot-based detector for smart grid networks. IEEE Trans Netw Serv Manag 21(4):4844–4860. https://doi.org/10.1109/TNSM.2024.3387710
Jaffal NO, Alkhanafseh M, Mohaisen D (2025) Large language models in cybersecurity: A survey of applications, vulnerabilities, and defense techniques. AI 6:1–45. https://doi.org/10.3390/ai6090216
Lanka P, Gupta K, Varol C (2024) Intelligent threat detection—AI-driven analysis of honeypot data to counter cyber threats. Electronics 13:1–28. https://doi.org/10.3390/electronics13132465
DeCusatis C, Tomo R, Singh A, Khoury E, Masone A (2025) Cybersecurity applications of near-term large language models. Electronics 14:1–14. https://doi.org/10.3390/electronics14132704
Weber SB, Feger M, Pilgermann M (2024) Don’t stop believin’: A unified evaluation approach for LLM honeypots. IEEE Access 12:144579–144587. https://doi.org/10.1109/ACCESS.2024.3472460
Ilg N, Germek D, Duplys P, Menth M (2025) Beekeeper: Accelerating honeypot analysis with LLM-driven feedback. IEEE Access 13:168034–168054. https://doi.org/10.1109/ACCESS.2025.3613118
Sezgin A (2025) Natural language interfaces for structured query generation in IoD platforms. Drones 9:1–20. https://doi.org/10.3390/drones9060444
Loumachi FY, Ghanem MC, Ferrag MA (2025) Advancing cyber incident timeline analysis through retrieval-augmented generation and large language models. Computers 14:1–42. https://doi.org/10.3390/computers14020067
Coppolino L, Iannaccone A, Nardone R, Petruolo A (2025) Asset discovery in critical infrastructures: An LLM-based approach. Electronics 14:1–24. https://doi.org/10.3390/electronics14163267
Wang Z, Wang Y, Xiong X, Ren Q, Huang J (2025) A novel framework for enhancing decision-making in autonomous cyber defense through graph embedding. Entropy 27:1–24. https://doi.org/10.3390/e27060622
Yang Q, Sun L, Pan H, Qiu C, Li P, Fang B, Liu Y, Tian Z (2025) Multistage-signaling-game-based camouflage defense strategy using reinforcement learning to mitigate the anti-honeypot attack. IEEE Internet Things J 15:41451–41464. https://doi.org/10.1109/JIOT.2025.3591024

Details

Primary Language

English

Subjects

System and Network Security, Natural Language Processing

Journal Section

Research Article

Authors

Anıl Sezgin ^*
0000-0002-5754-1380
Türkiye

Publication Date

July 30, 2026

Submission Date

January 5, 2026

Acceptance Date

May 13, 2026

Published in Issue

Year 2026 Volume: 6 Number: 2

DOI

https://doi.org/10.61112/jiens.1856246

IZ

https://izlik.org/JA89FE83WA

Cite

RIS / Bibtex

APA

Sezgin, A. (2026). AURA: Agent-based unified response architecture for retrieval-augmented cyber deception. Journal of Innovative Engineering and Natural Science, 6(2), 531-550. https://doi.org/10.61112/jiens.1856246

AMA

1.Sezgin A. AURA: Agent-based unified response architecture for retrieval-augmented cyber deception. JIENS. 2026;6(2):531-550. doi:10.61112/jiens.1856246

Chicago

Sezgin, Anıl. 2026. “AURA: Agent-Based Unified Response Architecture for Retrieval-Augmented Cyber Deception”. Journal of Innovative Engineering and Natural Science 6 (2): 531-50. https://doi.org/10.61112/jiens.1856246.

EndNote

Sezgin A (July 1, 2026) AURA: Agent-based unified response architecture for retrieval-augmented cyber deception. Journal of Innovative Engineering and Natural Science 6 2 531–550.

IEEE

[1]A. Sezgin, “AURA: Agent-based unified response architecture for retrieval-augmented cyber deception”, JIENS, vol. 6, no. 2, pp. 531–550, July 2026, doi: 10.61112/jiens.1856246.

ISNAD

Sezgin, Anıl. “AURA: Agent-Based Unified Response Architecture for Retrieval-Augmented Cyber Deception”. Journal of Innovative Engineering and Natural Science 6/2 (July 1, 2026): 531-550. https://doi.org/10.61112/jiens.1856246.

JAMA

1.Sezgin A. AURA: Agent-based unified response architecture for retrieval-augmented cyber deception. JIENS. 2026;6:531–550.

MLA

Sezgin, Anıl. “AURA: Agent-Based Unified Response Architecture for Retrieval-Augmented Cyber Deception”. Journal of Innovative Engineering and Natural Science, vol. 6, no. 2, July 2026, pp. 531-50, doi:10.61112/jiens.1856246.

Vancouver

1.Anıl Sezgin. AURA: Agent-based unified response architecture for retrieval-augmented cyber deception. JIENS. 2026 Jul. 1;6(2):531-50. doi:10.61112/jiens.1856246