Toward Adaptive Web Application Honeypots: Fine-Tuned Large Language Models for Realistic Response Emulation

With the rise of complex attacks, traditional web honeypots struggle to maintain authenticity due to static and easily fingerprinted responses. This paper presents a fine-tuned Large Language Model (LLM)-powered honeypot framework that generates dynamic, context-aware responses closely aligned with real web application behaviors. To achieve this, we collect realistic requests and responses from target applications, preprocess them by extracting essential information from requests and normalizing responses, and fine-tune the LLM on these request-response pairs. Experimental results demonstrate that the proposed method consistently outperforms both raw-training baselines and existing LLM-based honeypots, namely Galah and VelLMes. Specifically, it achieves higher similarity scores across all metrics, with Cosine similarity reaching 0.9396 compared to 0.4506 for Galah and 0.7357 for VelLMes. Moreover, it yields a substantially lower Levenshtein distance at 329.35 compared to 564.98 for the baseline, 2940.25 for Galah, and 2340.99 for VelLMes. These improvements confirm the model’s ability to generate highly realistic, structurally valid, and functionally robust responses, thereby enhancing attacker engagement and deception effectiveness.