Honey for the Agent: Cyber Deception and Behavioral Fingerprinting of LLM-Based Attackers

Dataset Overview This dataset contains interaction logs from an automated experiment in which large language models (LLMs) acted as autonomous SSH shell operators and issued commands to five different SSH environments: one real Ubuntu server and four variants of the Cowrie SSH honeypot. The dataset is designed to support research on LLM honeypot detection, reconnaissance behavior, and the influence of prompt framing on command-generation strategies. Research Context Each session simulates a scenario in which an LLM agent is given a system prompt instructing it to operate a Linux shell—either for general reconnaissance, deception detection, or exploitation—and is then connected to an SSH environment. The agent receives the terminal output of each command it issues and uses that information to determine its next command. The experiment varies four independent factors: LLM model SSH environment type System prompt framingMaximum number of interaction turns Folder Structure Logs_final/├── prompt_1/│ ├── 20/│ │ ├── environment/│ │ │ └── model/│ │ │ ├── session01.json│ │ │ ├── session02.json│ │ │ └── ...│ └── 30/│ └── ...├── prompt_2/├── prompt_3/├── prompt_4/├── prompt_5/└── prompt_6/ prompt_1–prompt_6: Six distinct LLM system prompts. 20 or 30: Maximum interaction turns allowed per session. environment: SSH environment type. model: LLM model identifier. Each experimental cell contains 30 independent sessions. Overall, the dataset contains approximately 16,200 session files. File Format Each session is stored as a single JSON file containing a sequence of interaction turns. Turn 0: Initialization A two-element list containing: [system_prompt_text, session_start_timestamp] Full system prompt provided to the LLM UTC session start timestamp [initial_shell_banner, connection_latency_ms] SSH welcome banner Connection establishment latency in milliseconds Turns 1–N: Interaction Each interaction turn contains three elements: [llm_raw_output, response_time_ms] Complete text generated by the LLM Time required to generate the response (milliseconds) [shell_output, execution_time_ms] Terminal output returned by the environment Total command execution and round-trip time (milliseconds) ["raw_command", parsed_command] Original command text extracted from the LLM response Parsed command that was actually executed Included Prompt Texts The dataset also includes an inputs.json file containing the task inputs used during the experiments. These inputs represent the initial user instructions provided to the LLM at the start of a session and define the specific objective of the interaction (e.g., reconnaissance, deception detection, or exploitation scenarios).