When Threat Scores Start Steering the Honeypot

TL;DR for operators

A deception system that responds the same way whether a session looks routine or highly suspicious leaves useful threat information unused. Chameleon tests a different design: estimated threat severity changes how aggressively the honeypot searches for engagement settings and which deception paths receive reinforcement, rather than merely changing the terminal reply.

At an anomaly score of $A(t)=0.85$, its threat-conditioned particle swarm optimizer reached mean final fitness of 3.85 versus 2.60 for standard PSO and converged 32.7% faster across five seeded simulation runs. A separate severity-aware tree mechanism similarly directs more reinforcement toward higher-risk deception paths while limiting tree growth.

For security operations, the consequential question is whether a model-estimated threat score should become a real-time resource-allocation signal. That would make adaptation a closed control loop: higher-risk interactions can receive more deception effort instead of AI being used only at the response layer. The evidence is promising but provisional—the optimizer results come from simulation, and the paper does not validate the complete system against live attackers.

A suspicious session should change more than the reply

A honeypot that behaves the same way regardless of what it observes leaves useful information unused. A routine probe and a command sequence that looks strongly malicious do not necessarily deserve the same engagement time, computational effort, or depth of deception.

Chameleon¹ turns that distinction into a control problem. Incoming payloads are normalized and classified, and sufficiently suspicious sessions can enter a deception engine whose optimization behavior depends on the estimated threat level. The local language model is also used for more than terminal dialogue: it produces a severity signal that influences how deceptive filesystem paths are reinforced.

That feedback loop is the paper’s main architectural contribution. At $A(t)=0.85$, its threat-calibrated particle swarm optimizer reports mean final fitness of 3.85 against 2.60 for standard PSO across seeds 42–46, a 48.1% increase, alongside 32.7% faster convergence. These are simulation results, but they make the underlying design question concrete: should threat assessment merely label an interaction, or should it also change how the system spends effort on that interaction?

The anomaly score changes how aggressively the system searches

The first mechanism applies the BiLSTM classifier’s anomaly score to particle swarm optimization of connection-holding delays.

Standard PSO carries some momentum from previous search steps. Chameleon makes that inertia responsive to the current anomaly score:

As $A(t)$ rises, inertia falls. Under the paper’s interpretation, the swarm moves away from broader exploration and toward faster exploitation of configurations that already appear promising for engagement.

The objective is threat-sensitive as well: the interaction bonus receives greater weight as the anomaly score rises. The two changes have the same operational direction. A session judged more suspicious causes the optimizer to concentrate more quickly on settings intended to prolong useful interaction.

The five-run PSO comparison is the paper’s main evidence for this mechanism, rather than an ablation or robustness exercise.

The result supports a narrower claim than “AI makes honeypots better.” Under the authors’ simulated objective and fixed $A(t)=0.85$ condition, allowing the threat score to alter swarm behavior outperformed their standard-PSO baseline.

Language-model severity determines which deception paths receive reinforcement

The second mechanism begins with a different control problem. Richer deceptive environments may create more opportunities to sustain an attacker’s interaction, but an expanding deception tree also consumes memory.

Chameleon uses its locally deployed Qwen3.5-0.8B model to assign observed command sequences a Payload Severity Index, $\Psi$, from 1.0 to 3.0. That signal is then used outside language generation. In Semantic Deception RRT, reinforcement is scaled as:

At $\Psi=3.0$, the paper reports a 7.39-fold multiplier relative to the baseline update at $\Psi=1.0$. Higher-severity paths consequently receive disproportionate reinforcement.

A separate depth-decay rule reduces expansion probability as the tree approaches its maximum depth of six, with a probability floor of 0.1. This is a memory-control mechanism, not evidence that deeper trees are intrinsically better.

The associated head-to-head simulation provides the main comparative evidence. Across five runs, S-RRT reports best-run fitness of 1,615.8 versus 450.2 for standard RRT. At the critical severity setting $\Psi=3.0$, fitness is 1,135.75 versus 264.64, a 329.2% increase, while reported memory usage falls 24.9%.

The two optimizers are thus less separate than their names suggest. Both use estimated threat severity to concentrate system resources: one changes exploration versus exploitation in parameter search; the other changes reinforcement intensity in deception-tree evolution.

The cheap-inference claim depends on a cascade

Chameleon does not send every interaction through its language model. The paper describes a cascade in which roughly 95% of sessions remain at the BiLSTM stage and about 5% trigger language-model inference.

That architecture matters more operationally than the model size alone. The BiLSTM is reported at roughly 2 ms CPU inference time and 99.61% classification accuracy. Qwen3.5-0.8B reaches 90% contextual generation accuracy under expert review, while the weighted classifier-plus-language-model pipeline is reported at about 4.5 ms average latency.

This is the basis for a plausible business inference: conditional computation can make adaptive deception affordable when expensive behavior is reserved for sessions that appear to justify it.

The paper also estimates approximately USD 17 per month for a single-core, 4 GB cloud deployment, compared with roughly USD 8,333 per month for entry-level commercial deception platforms. That approximately 490-fold ratio is a pricing comparison, not a total-cost-of-ownership study. It does not measure engineering support, monitoring, integration, incident handling, or feature parity.

The validation suite checks implementation claims, not attacker effectiveness

Several reported results answer different questions and should not be combined into one headline measure of “honeypot accuracy.”

The classifier result also deserves a specific data-quality note. The source record reports that the confusion-matrix caption describes a 50,000-sample test-set evaluation, while the four displayed cells sum to 8,303. The available record does not resolve that inconsistency. It does not negate the architecture, but it makes precise interpretation of the 99.61% figure less straightforward.

The deterministic suite is useful reproducibility infrastructure. It reportedly completes 91 tests without failures apart from a documented severe-condition early-convergence edge case handled through multi-run aggregation. That is evidence that the implementation follows its stated mathematical constraints. It is not a substitute for an adversarial field evaluation.

The operational experiment is threat-conditioned resource allocation

For a security engineering team, Chameleon suggests a specific experiment before any production claim: test whether estimated severity can improve the allocation of deception effort.

The affected decision is concrete. When a session crosses a sufficiently high threat threshold, should the system spend more time holding the connection, expose a richer deceptive environment, and invoke a local generative model? When the score remains low, should it keep interaction cheap?

Cognaptus would treat the current paper as support for prototyping that policy in a controlled environment, with measurements such as attacker dwell time, false escalation rate, intelligence collected per session, resource consumption, and stability under varying threat-score calibration. Those measures are business-facing extensions of the paper’s mechanism; they were not established by the reported experiments.

The unresolved issue is whether optimizing the paper’s internal fitness functions translates into durable deception against adaptive human attackers or offensive tooling. Five-seed simulations show that the proposed control rules can outperform the chosen PSO and RRT baselines. They do not yet show that attackers remain engaged longer, reveal more useful intelligence, fail to fingerprint the honeypot, or create less operational risk.

Chameleon’s useful contribution is consequently architectural: it treats threat estimation as an input to what the system does next, not merely to what label it records. The next evidence threshold is no longer another optimizer score. It is whether that control loop produces measurably better security outcomes when an adversary is actually interacting with it.

Cognaptus: Automate the Present, Incubate the Future.