{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T17:19:11Z","timestamp":1786987151688,"version":"build-2736575974"},"reference-count":39,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100004826","name":"Natural Science Foundation of Beijing Municipality","doi-asserted-by":"publisher","award":["L234033"],"award-info":[{"award-number":["L234033"]}],"id":[{"id":"10.13039\/501100004826","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Networks"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.comnet.2026.112223","type":"journal-article","created":{"date-parts":[[2026,3,21]],"date-time":"2026-03-21T15:58:02Z","timestamp":1774108682000},"page":"112223","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":3,"special_numbering":"C","title":["HoneyGPT: Breaking the trilemma in honeypots with large language models"],"prefix":"10.1016","volume":"282","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-8724-0806","authenticated-orcid":false,"given":"Ziyang","family":"Wang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-2589-3335","authenticated-orcid":false,"given":"Jianzhou","family":"You","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4174-3009","authenticated-orcid":false,"given":"Haining","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-6362-182X","authenticated-orcid":false,"given":"Tianwei","family":"Yuan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0549-0999","authenticated-orcid":false,"given":"Shichao","family":"Lv","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9438-6060","authenticated-orcid":false,"given":"Yang","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2745-7521","authenticated-orcid":false,"given":"Limin","family":"Sun","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.comnet.2026.112223_bib0001","series-title":"Proceedings of the 2020ACM SIGSAC Conference on Computer and Communications Security","article-title":"HoneyPLC: a next-Generation honeypot for industrial control systems","author":"L\u00f3pez-Morales","year":"2020"},{"key":"10.1016\/j.comnet.2026.112223_bib0002","series-title":"14Th USENIX Security Symposium","article-title":"Detecting targeted attacks using shadow honeypots","author":"Anagnostakis","year":"2005"},{"key":"10.1016\/j.comnet.2026.112223_bib0003","article-title":"Resource-aware detection and defense system against multi-type attacks in the cloud: repeated bayesian stackelberg game","author":"Wahab","year":"2019","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"10.1016\/j.comnet.2026.112223_bib0004","article-title":"Dnic architectural developments for 0-knowledge detection of OPC malware","author":"Rrushi","year":"2018","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"10.1016\/j.comnet.2026.112223_bib0005","article-title":"Collaborative honeypot defense in UAV networks: a learning-based game approach","author":"Wang","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2026.112223_bib0006","doi-asserted-by":"crossref","DOI":"10.1109\/TIFS.2021.3118886","article-title":"Duplicity games for deception design with an application to insider threat mitigation","author":"Huang","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2026.112223_bib0007","series-title":"13Th USENIX Security Symposium","article-title":"A virtual honeypot framework","author":"Niels","year":"2004"},{"key":"10.1016\/j.comnet.2026.112223_bib0008","article-title":"Large model based agents: state-of-the-art, cooperation paradigms, security and privacy, and future trends","author":"Wang","year":"2025","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"10.1016\/j.comnet.2026.112223_bib0009","unstructured":"J. Kaplan, S. McCandlish, T. Henighan, T.B. Brown, B. Chess, R. Child, S. Gray, A. Radford, J. Wu, D. Amodei, Scaling laws for neural language models,(2020). arXiv: 2001.08361."},{"key":"10.1016\/j.comnet.2026.112223_bib0010","unstructured":"J. Wei, Y. Tay, R. Bommasani, C. Raffel, B. Zoph, S. Borgeaud, D. Yogatama, M. Bosma, D. Zhou, D. Metzler, E.H. Chi, T. Hashimoto, O. Vinyals, P. Liang, J. Dean, W. Fedus, Emergent abilities of large language models,(2022). arXiv: 2206.07682."},{"key":"10.1016\/j.comnet.2026.112223_bib0011","article-title":"How does GPT obtain its ability? tracing emergent abilities of language models to their sources","author":"Fu","year":"2022","journal-title":"Yao Fu\u2019s Notion"},{"key":"10.1016\/j.comnet.2026.112223_bib0012","series-title":"Advances in Neural Information Processing Systems","article-title":"Towards revealing the mystery behind chain of thought: a theoretical perspective","author":"Feng","year":"2024"},{"key":"10.1016\/j.comnet.2026.112223_bib0013","series-title":"Advances in Neural Information Processing Systems","article-title":"Chain of thought imitation with procedure cloning","author":"Yang","year":"2022"},{"key":"10.1016\/j.comnet.2026.112223_bib0014","series-title":"2024IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","first-page":"430","article-title":"Llm in the shell: generative honeypots","author":"Sladi\u0107","year":"2024"},{"key":"10.1016\/j.comnet.2026.112223_bib0015","series-title":"2024IEEE Conference on Communications and Network Security (CNS)","first-page":"1","article-title":"LLM Honeypot: leveraging large language models as advanced interactive honeypot systems","author":"Otal","year":"2024"},{"key":"10.1016\/j.comnet.2026.112223_bib0016","unstructured":"openai, chatgpt, 2025, ([Online]). https:\/\/openai.com\/blog\/chatgpt\/."},{"key":"10.1016\/j.comnet.2026.112223_bib0017","series-title":"Proceedings of the 31St Annual Network and Distributed System Security Symposium","article-title":"Large language model guided protocol fuzzing","author":"Meng","year":"2024"},{"key":"10.1016\/j.comnet.2026.112223_bib0018","series-title":"Proceedings of the 31St Annual Network and Distributed System Security Symposium","article-title":"DeGPT: optimizing decompiler output with LLM","author":"Hu","year":"2024"},{"key":"10.1016\/j.comnet.2026.112223_bib0019","series-title":"Proceedings of the 2023ACM SIGSAC Conference on Computer and Communications Security","article-title":"Large language models for code: security hardening and adversarial testing","author":"He","year":"2023"},{"key":"10.1016\/j.comnet.2026.112223_bib0020","series-title":"2023IEEE Symposium on Security and Privacy","article-title":"Examining zero-shot vulnerability repair with large language models","author":"Pearce","year":"2023"},{"key":"10.1016\/j.comnet.2026.112223_bib0021","series-title":"2022IEEE Symposium on Security and Privacy","article-title":"Asleep at the keyboard? assessing the security of github copilot\u2019s code contributions","author":"Pearce","year":"2022"},{"key":"10.1016\/j.comnet.2026.112223_bib0022","series-title":"2024IEEE Symposium on Security and Privacy","article-title":"Moderating new waves of online hate with chain-of-Thought reasoning in large language models","author":"Vishwamitra","year":"2024"},{"key":"10.1016\/j.comnet.2026.112223_bib0023","series-title":"Advances in Neural Information Processing Systems","article-title":"Language models are few-shot learners","author":"Brown","year":"2020"},{"key":"10.1016\/j.comnet.2026.112223_bib0024","series-title":"Advances in Neural Information Processing Systems","article-title":"Training language models to follow instructions with human feedback","author":"Ouyang","year":"2022"},{"key":"10.1016\/j.comnet.2026.112223_bib0025","series-title":"Advances in Neural Information Processing Systems","article-title":"Chain-of-Thought prompting elicits reasoning in large language models","author":"Wei","year":"2022"},{"key":"10.1016\/j.comnet.2026.112223_bib0026","series-title":"Advances in Neural Information Processing Systems","article-title":"Learn to explain: multimodal reasoning via thought chains for science question answering","author":"Lu","year":"2022"},{"key":"10.1016\/j.comnet.2026.112223_bib0027","series-title":"Advances in Neural Information Processing Systems","article-title":"Generating natural language proofs with verifier-Guided search","author":"Yang","year":"2022"},{"key":"10.1016\/j.comnet.2026.112223_bib0028","series-title":"Advances in Neural Information Processing Systems","article-title":"Star: self-taught reasoner bootstrapping reasoning with reasoning","author":"Zelikman","year":"2022"},{"key":"10.1016\/j.comnet.2026.112223_bib0029","unstructured":"M. OOSTERHOF, Cowrie, 2025, ([Online]). https:\/\/github.com\/micheloosterhof\/cowrie."},{"key":"10.1016\/j.comnet.2026.112223_bib0030","series-title":"12Th USENIX Workshop on Offensive Technologies","article-title":"Bitter harvest: systematically fingerprinting low- and medium-interaction honeypots at internet scale","author":"Alexander","year":"2018"},{"key":"10.1016\/j.comnet.2026.112223_bib0031","series-title":"31St USENIX Security Symposium","article-title":"{CamShield}: Securing smart cameras through physical replication and isolation","author":"Wang","year":"2022"},{"key":"10.1016\/j.comnet.2026.112223_bib0032","series-title":"2021IEEE 27Th Real-Time and Embedded Technology and Applications Symposium","article-title":"Brief industry paper: catching IoT malware in the wild using honeyiot","author":"Xu","year":"2021"},{"key":"10.1016\/j.comnet.2026.112223_bib0033","series-title":"ICC 2021-IEEE International Conference on Communications","article-title":"HoneyVP: a cost-effective hybrid honeypot architecture for industrial control systems","author":"You","year":"2021"},{"issue":"10","key":"10.1016\/j.comnet.2026.112223_bib0034","doi-asserted-by":"crossref","first-page":"10512","DOI":"10.1109\/TII.2023.3240739","article-title":"Neupot: a neural network-based honeypot for detecting cyber threats in industrial control systems","volume":"19","author":"Shan","year":"2023","journal-title":"IEEE Trans. Ind. Inf."},{"key":"10.1016\/j.comnet.2026.112223_bib0035","doi-asserted-by":"crossref","first-page":"117528","DOI":"10.1109\/ACCESS.2023.3326104","article-title":"On designing low-risk honeypots using generative pre-trained transformer models with curated inputs","volume":"11","author":"Ragsdale","year":"2023","journal-title":"IEEE Access"},{"key":"10.1016\/j.comnet.2026.112223_bib0036","series-title":"2024IEEE Conference on Communications and Network Security (CNS)","first-page":"1","article-title":"HoneyLLM: enabling shell honeypots with large language models","author":"Guan","year":"2024"},{"key":"10.1016\/j.comnet.2026.112223_bib0037","series-title":"2021 6Th International Conference on Computer Science and Engineering","article-title":"Ssh and telnet protocols attack analysis using honeypot technique: analysis of ssh and telnet honeypot","author":"Ba\u015fer","year":"2021"},{"key":"10.1016\/j.comnet.2026.112223_bib0038","doi-asserted-by":"crossref","DOI":"10.1038\/s41598-023-28613-0","article-title":"Containerized cloud-based honeypot deception for tracking attackers","author":"Priya","year":"2023","journal-title":"Sci. Rep."},{"key":"10.1016\/j.comnet.2026.112223_bib0039","series-title":"Technical Report","article-title":"Mitre att&ck: design and philosophy","author":"Strom","year":"2018"}],"container-title":["Computer Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626002355?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626002355?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T15:50:14Z","timestamp":1780415414000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1389128626002355"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":39,"alternative-id":["S1389128626002355"],"URL":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112223","relation":{},"ISSN":["1389-1286"],"issn-type":[{"value":"1389-1286","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"HoneyGPT: Breaking the trilemma in honeypots with large language models","name":"articletitle","label":"Article Title"},{"value":"Computer Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112223","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"112223"}}