AURA: Agent-based unified response architecture for retrieval-augmented cyber deception

The accelerated development of large language models (LLMs) has redefined the security defense landscape by providing the means to implement adaptive deception systems that can be contextually aware of the environment in which the deception must be implemented. In this paper, the authors propose a multi-agent honeypot system, AURA, which incorporates a new form of deception using a Retrieval-Augmented Generation (RAG) model to mimic command-line interfaces in an adversarial environment. A dataset of 1,500 command-response pairs, implemented using a Linux environment, was used to test the effectiveness of the model, which was evaluated over 10 different experimental configurations. The results of the experiment show a marked improvement in the effectiveness of the model, which was augmented using the RAG model, over the traditional model used as a baseline. The BLEU score was raised from 0.1455 to 0.4621, the ROUGE-L (F1) score was raised from 0.2665 to 0.5740, the METEOR score was raised from 0.2441 to 0.5282, and the Jaccard similarity was raised from 0.2244 to 0.5189, which represent an increase of over 100% in the effectiveness of the model over the traditional model used as a baseline. In the experiment, all agents of the AURA honeypot system used the Llama 3.1 8B model as the reasoning engine, which shows the effectiveness of the model in providing a secure means of implementing autonomous deception systems using a multi-agent architecture, which can be used to implement next-generation autonomous honeypots.