In recent years, social networks have struggled to meet user protection and fraud prevention requirements under unpredictable risks. Anonymity features are widely used to help individuals maintain their privacy, but they can also be exploited for malicious purposes. In this study, we develop a machine learning-driven de-anonymization system for social networks, with a focus on feature selection, hyperparameter tuning, and dimensionality reduction. Using supervised learning techniques, the system achieves high accuracy in identifying user identities from anonymized datasets. In experiments conducted on real and synthetic data, the optimized models consistently outperform baseline methods on average. Even in cases where they do not, significant improvements in precision are observed. Ethical considerations surrounding de-anonymization are thoroughly discussed, including the responsibility of implementation to maintain a balance between privacy and security. By proposing a scalable and effective framework for analyzing anonymized data in social networks, this research contributes to improved fraud detection and strengthened Internet security.

This article investigates contemporary advancements in information security technologies, with a focus on automated access control systems and their integration with biometric solutions. Particular emphasis is placed on the potential of facial recognition technologies to strengthen security protocols and streamline access management for restricted areas. A Python-based implementation utilizing the OpenCV library is presented, demonstrating real-time recognition capabilities and dynamic visitor data handling. In contrast to earlier conceptual works, this study provides a detailed description of the applied recognition algorithm, training procedure, and evaluation methodology. The system was tested in 200 experimental trials with 20 participants under varying conditions, including changes in lighting, distance, and partial occlusions such as masks and sunglasses. Performance metrics – accuracy, precision, recall, and F1-score – were calculated based on confusion-matrix analysis. The results confirm that the proposed prototype ensures reliable operation in diverse environments, offering a scalable and cost-effective solution for enhancing access control mechanisms. By combining technical rigor with practical implementation, the study underscores the feasibility of adopting facial recognition systems to improve both security and operational efficiency.

Linux servers exposed via Secure Shell (SSH) remain a major target in command-driven cyber intrusions, yet conventional low- and medium-interaction honeypots often provide unrealistic responses and limited session state, causing attackers to terminate sessions before later attack stages can be observed. This paper proposes an intelligent SSH honeypot based on large language models that maintains context-aware terminal interaction while simultaneously supporting semantic analysis of attacker command streams. The system combines an SSH front-end, an LLM processing layer, centralized logging, and an embedding-based analytics pipeline for clustering commands and mapping them to attack stages such as reconnaissance, exploitation, and persistence. The language model is fine-tuned for Linux command understanding and realistic response generation, and the proposed method is evaluated against token-based and ngram baselines. Results from a six-month distributed deployment with approximately four million interaction events show that the LLM-enhanced approach improves command recognition performance to an F1-score of 0.90 and increases attacker engagement by extending session depth and duration. The findings indicate that LLM-assisted honeypots can provide more realistic deception and richer threatintelligence telemetry from Linux-based cyber incidents.

Secure Shell (SSH) intrusions against Linux servers remain a dominant vector of opportunistic and targeted cyber incidents, yet operational honeypots treat attacker commands either as isolated lookup keys for static templates or as input to a single uniform language model. Two research directions partially address this gap: LLM-driven response generation raises interaction realism but incurs a fidelity–latency trade-off, while semantic command analytics classifies attack stages from embeddings yet applies a single fine-tuned model uniformly across sessions. This work introduces the phase-adaptive model routing framework (PAMR), which explicitly couples both views. A lightweight online phase estimator infers the current attack stage—reconnaissance, exploitation, or persistence—from a sliding window of recent commands via compact semantic embeddings; a router then dispatches each command to one of several heterogeneous LLM backends according to estimated phase, command complexity, and a confidence-weighted latency budget. The routing decision is formulated as a constrained optimization problem and realized at runtime as an $O\left(1\right)$ lookup in a precomputed dispatch table. PAMR is evaluated on a controlled, reproducible benchmark of 412 stage-annotated command sessions that combines representative Linux command–response pairs with synthesized attacker traces; we explicitly state that this is a laboratory benchmark rather than live attacker traffic, and we scope our claims accordingly. Relative to uniform-model baselines, PAMR reduces mean response latency by approximately 38% against an API-hosted high-capacity backend and by approximately 45% against a locally hosted mid-capacity backend, while keeping token-level response-fidelity metrics close to the high-capacity baseline (cosine similarity ≈ 0.39 vs. 0.40) and maintaining an online stage-classification macro-F1 above 0.87. We further provide a first-order analytical treatment of the timing side-channel that any backend-routing architecture introduces, and we frame the contribution as a latency/token-fidelity trade-off, leaving validation of operational realism against live adversaries to future work.

Large language model (LLM) backends increasingly generate SSH-honeypot output, yet the literature fixes one backend per system and judges realism by human evaluators, never asking which LLM is fit to play the shell or measuring the catastrophic failure of a backend leaking its own instructions. We fix one hardened unprivileged user scaffold and prompt, vary only the backend across eleven LLMs, and replace the human judge with an objective, prompt-anchored leakage metric. Across a controlled 42-command battery (20 trials each; 8736 responses) and a live adaptive corpus (8626 responses), we score six dimensions: instruction leakage, fidelity, hallucination, latency, verbosity, and stability. Exactly one backend (gemma-4-31b-it) reproduces verbatim leakage in both datasets and is disqualified; the other ten never leak. A deterministic handler layer serves 33 of 42 commands identically across backends, confining model risk to nine generative commands, where flag fabrication ranges 0–95%, latency spans an order of magnitude, and a held-out classifier identifies the backend from one response at 71% versus 9% chance, a fingerprinting risk. We report a per-dimension scorecard rather than a weight-sensitive ranking. Honeypot safety on the privilege boundary is a property of the architecture; realism, speed, cost, and one catastrophic leak are properties of the model.

Large Language Model (LLM)-driven Secure Shell (SSH) honeypots have rapidly displaced static, templated decoys, yet they share a structural limitation: a single model and a single policy serve every turn of an intrusion, from low-stakes reconnaissance to high-value persistence. This review asks whether honeypots can instead adapt their inference to the attacker’s phase. We conduct a Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020-guided systematic mapping review of fifty influential studies (2020–2026) drawn from three strands—honeypots and generative deception, cost-aware model routing and mixture-of-experts inference, and LLM agents, embeddings, and retrieval-augmented generation in security operations—assembled under a disclosed, purposive top-50 prioritization ranked by age-normalized citation velocity. That prioritization is a deliberate mapping strategy: it surfaces the field’s most influential work rather than claiming exhaustive coverage, and a sensitivity analysis tests how robust the conclusions are to the cap. Three findings emerge. Across the reviewed literature, honeypot adaptivity has advanced at the policy and generation layers but not at the inference-allocation layer; the routing literature has solved capacity allocation but conditions only on query-intrinsic signals, not on adversarial session phase; and embedding-based analytics, corroborated by a production deployment, show the phase signal is observable and reliable. The strands are individually mature and mutually disconnected. We formalize this gap and propose a phase-adaptive, agent-oriented framework that pairs an embedding-based phase estimator and an O(1) phase-to-model dispatch layer with an unprivileged, campaign-level observation substrate.The review contributes a reproducible corpus, an age-normalized bibliometric ranking, a formal gap analysis, and a conceptual architecture that operationalizes the maturation arc from static to phase-adaptive honeypots.