QRASSH - A Self-Adaptive SSH Honeypot Driven by Q-Learning

Abstract

Developed for the first time in the 80s, honeypot systems research increased tremendously in the last decade. Moving from simple monitored, emulated, Internet Services, towards intelligent systems that autonomously interact with attackers, was a normal engagement in the context of higher development of artificial intelligence as science. In this paper we present a newly developed SSH self-adaptive honeypot system that uses a Deep Q-Learning algorithm in order to decide how to interact with external attackers. The honeypot system is developed in Python and integrates an existing implementation of a Reinforcement Learning algorithm that makes use of neural network (NN).