MySQL-Pot: A LLM-Based Honeypot for MySQL Threat Protection

Traditional network defense techniques such as firewalls and intrusion detection systems [1] primarily involve passive defense, which often struggles to effectively counter the omnipresent and ever-evolving threat landscape. The advent of honeypot technology has introduced a paradigm shift in network defense, enabling a more proactive approach by attracting and deceiving attackers. Honeypots facilitate the study of attackers' motives and techniques, ultimately delaying or preventing destructive attacks and safeguarding real service resources. In this paper, we introduce a MySQL protocol simulation honeypot, which represents an intelligent interactive honeypot system capable of generating responses using a LLM (Large Language Model). With the help of LLM language understanding capabilities, the honeypot learns the behavior of SQL (Structured Query Language) requests and continues to engage with attackers, which provides optimal simulated responses to attack requests instead of erroneous ones. We conducted comparative experiments with an open-source MySQL database honeypot, and the results indicate that our interactive approach improves session length and response speed compared to existing interaction methods.