In recent years, social networks have struggled to meet user protection and fraud prevention requirements under unpredictable risks. Anonymity features are widely used to help individuals maintain their privacy, but they can also be exploited for malicious purposes. In this study, we develop a machine learning-driven de-anonymization system for social networks, with a focus on feature selection, hyperparameter tuning, and dimensionality reduction. Using supervised learning techniques, the system achieves high accuracy in identifying user identities from anonymized datasets. In experiments conducted on real and synthetic data, the optimized models consistently outperform baseline methods on average. Even in cases where they do not, significant improvements in precision are observed. Ethical considerations surrounding de-anonymization are thoroughly discussed, including the responsibility of implementation to maintain a balance between privacy and security. By proposing a scalable and effective framework for analyzing anonymized data in social networks, this research contributes to improved fraud detection and strengthened Internet security.

Network intrusion detection has challenges that fundamentally differ from language and vision tasks typically addressed by Transformer models. In particular, network traffic features lack inherent ordering, datasets are extremely class-imbalanced (with benign traffic often exceeding 80%), and reported accuracies in the literature vary widely (57–95%) without systematic explanation. To address these challenges, we propose a controlled experimental study that isolates and quantifies the impact of tokenization strategies on Transformer-based intrusion detection systems. Specifically, we introduce and compare three tokenization approaches—feature-wise tokenization (78 tokens) based on CICIDS2017, a sample-wise single-token baseline, and an optimized sample-wise tokenization—under identical training and evaluation protocols on a highly imbalanced intrusion detection dataset. We demonstrate that tokenization choice alone accounts for an accuracy gap of 37.43 percentage points, improving performance from 57.09% to 94.52% (100 K data). Furthermore, we show that architectural mechanisms for handling class imbalance—namely Batch Normalization and capped loss weights—yield an additional 15.05% improvement, making them approximately 21× more effective than increasing the training data by 50%. We achieve a macro-average AUC of 0.98, improve minority-class recall by 7–12%, and maintain strong discrimination even for classes with as few as four samples (AUC 0.9811). These results highlight tokenization and imbalance-aware architectural design as primary drivers of performance in Transformer-based intrusion detection and contribute practical guidance for deploying such models in modern network infrastructures, including IoT and cloud environments where extreme class imbalance is inherent. This study also presents practical implementation scheme recommending sample-wise tokenization, constrained class weighting, and Batch Normalization after embedding and classification layers to improve stability and performance in highly unstable table-based IDS problems.

Linux servers exposed via Secure Shell (SSH) remain a major target in command-driven cyber intrusions, yet conventional low- and medium-interaction honeypots often provide unrealistic responses and limited session state, causing attackers to terminate sessions before later attack stages can be observed. This paper proposes an intelligent SSH honeypot based on large language models that maintains context-aware terminal interaction while simultaneously supporting semantic analysis of attacker command streams. The system combines an SSH front-end, an LLM processing layer, centralized logging, and an embedding-based analytics pipeline for clustering commands and mapping them to attack stages such as reconnaissance, exploitation, and persistence. The language model is fine-tuned for Linux command understanding and realistic response generation, and the proposed method is evaluated against token-based and ngram baselines. Results from a six-month distributed deployment with approximately four million interaction events show that the LLM-enhanced approach improves command recognition performance to an F1-score of 0.90 and increases attacker engagement by extending session depth and duration. The findings indicate that LLM-assisted honeypots can provide more realistic deception and richer threatintelligence telemetry from Linux-based cyber incidents.

Secure Shell (SSH) intrusions against Linux servers remain a dominant vector of opportunistic and targeted cyber incidents, yet operational honeypots treat attacker commands either as isolated lookup keys for static templates or as input to a single uniform language model. Two research directions partially address this gap: LLM-driven response generation raises interaction realism but incurs a fidelity–latency trade-off, while semantic command analytics classifies attack stages from embeddings yet applies a single fine-tuned model uniformly across sessions. This work introduces the phase-adaptive model routing framework (PAMR), which explicitly couples both views. A lightweight online phase estimator infers the current attack stage—reconnaissance, exploitation, or persistence—from a sliding window of recent commands via compact semantic embeddings; a router then dispatches each command to one of several heterogeneous LLM backends according to estimated phase, command complexity, and a confidence-weighted latency budget. The routing decision is formulated as a constrained optimization problem and realized at runtime as an $O\left(1\right)$ lookup in a precomputed dispatch table. PAMR is evaluated on a controlled, reproducible benchmark of 412 stage-annotated command sessions that combines representative Linux command–response pairs with synthesized attacker traces; we explicitly state that this is a laboratory benchmark rather than live attacker traffic, and we scope our claims accordingly. Relative to uniform-model baselines, PAMR reduces mean response latency by approximately 38% against an API-hosted high-capacity backend and by approximately 45% against a locally hosted mid-capacity backend, while keeping token-level response-fidelity metrics close to the high-capacity baseline (cosine similarity ≈ 0.39 vs. 0.40) and maintaining an online stage-classification macro-F1 above 0.87. We further provide a first-order analytical treatment of the timing side-channel that any backend-routing architecture introduces, and we frame the contribution as a latency/token-fidelity trade-off, leaving validation of operational realism against live adversaries to future work.

Large Language Model (LLM)-driven Secure Shell (SSH) honeypots have rapidly displaced static, templated decoys, yet they share a structural limitation: a single model and a single policy serve every turn of an intrusion, from low-stakes reconnaissance to high-value persistence. This review asks whether honeypots can instead adapt their inference to the attacker’s phase. We conduct a Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020-guided systematic mapping review of fifty influential studies (2020–2026) drawn from three strands—honeypots and generative deception, cost-aware model routing and mixture-of-experts inference, and LLM agents, embeddings, and retrieval-augmented generation in security operations—assembled under a disclosed, purposive top-50 prioritization ranked by age-normalized citation velocity. That prioritization is a deliberate mapping strategy: it surfaces the field’s most influential work rather than claiming exhaustive coverage, and a sensitivity analysis tests how robust the conclusions are to the cap. Three findings emerge. Across the reviewed literature, honeypot adaptivity has advanced at the policy and generation layers but not at the inference-allocation layer; the routing literature has solved capacity allocation but conditions only on query-intrinsic signals, not on adversarial session phase; and embedding-based analytics, corroborated by a production deployment, show the phase signal is observable and reliable. The strands are individually mature and mutually disconnected. We formalize this gap and propose a phase-adaptive, agent-oriented framework that pairs an embedding-based phase estimator and an O(1) phase-to-model dispatch layer with an unprivileged, campaign-level observation substrate.The review contributes a reproducible corpus, an age-normalized bibliometric ranking, a formal gap analysis, and a conceptual architecture that operationalizes the maturation arc from static to phase-adaptive honeypots.

Large language model (LLM) backends increasingly generate SSH-honeypot output, yet the literature fixes one backend per system and judges realism by human evaluators, never asking which LLM is fit to play the shell or measuring the catastrophic failure of a backend leaking its own instructions. We fix one hardened unprivileged user scaffold and prompt, vary only the backend across eleven LLMs, and replace the human judge with an objective, prompt-anchored leakage metric. Across a controlled 42-command battery (20 trials each; 8736 responses) and a live adaptive corpus (8626 responses), we score six dimensions: instruction leakage, fidelity, hallucination, latency, verbosity, and stability. Exactly one backend (gemma-4-31b-it) reproduces verbatim leakage in both datasets and is disqualified; the other ten never leak. A deterministic handler layer serves 33 of 42 commands identically across backends, confining model risk to nine generative commands, where flag fabrication ranges 0–95%, latency spans an order of magnitude, and a held-out classifier identifies the backend from one response at 71% versus 9% chance, a fingerprinting risk. We report a per-dimension scorecard rather than a weight-sensitive ranking. Honeypot safety on the privilege boundary is a property of the architecture; realism, speed, cost, and one catastrophic leak are properties of the model.