Behavioral Discrimination of Autonomous LLM Agents, Scripted Bots, and Human Operators in Live Honeypot Traffic: A Statistically Validated, Black-Box Evasion-Resistant Multi-Feature Classifier

This repository contains the de-identified session-level feature-vector dataset and the complete analysis code for the paper: > **Behavioral Discrimination of Autonomous LLM Agents, Scripted Bots, and Human Operators in Live Honeypot Traffic: A Statistically Validated, Black-Box Evasion-Resistant Multi-Feature Classifier**> Sridhar G, J. B. Simha, and Rashmi Agarwal> *IEEE Access*, submitted 2026 The paper addresses the three-class operator-attribution problem: given a single honeypot session, determine whether it was generated by a scripted bot, an autonomous LLM-powered attack agent, or a human operator. It introduces a 19-dimensional behavioral feature set, a triangulated ground-truth labeling protocol that avoids the circularity problem inherent in prior work, and an evasion-resistance analysis covering black-box adversaries.