Cyberattack Observation Using IoT Honeypots at Yokohama National University#

Takayuki Sasaki (with Katsunari Yoshioka), Yokohama National University

• Why: Not IoT per se — the signal is the operational pattern: a hybrid rule-engine-plus-LLM triage pipeline that turns a honeypot into a near-real-time exploit classifier. That AI-assisted-triage design is where security operations tooling is heading, demonstrated on real long-running data with a public dataset release.
• What: X-POT, an adaptive HTTP honeypot that emulates a wide range of IoT devices using real WebUI HTML collected by scanning IP ranges around observed attackers — so the honeypot presents genuinely realistic device interfaces. The analysis pipeline: identify attacks (payloads fetching malware via wget/curl), tag against rules, classify novel exploits by request-path/parameter patterns, alert the operator immediately on new exploits, and auto-generate analysis reports with GPT-5 plus web search — sent to Slack, manually verified, then turned into new tagging rules. Long-term operation captured entire exploit lifecycles from emergence to decline, including zero-days and campaigns against industrial targets like solar power monitors.
• How: Two components — attack observation (emulation + malware collection) and HTTP response collection (scanning attacker neighborhoods to harvest device WebUIs); the LLM proposes, the human verifies before rules ship.
• Where applicable: University research deployment, but the rule+LLM hybrid with human-in-the-loop verification is a pattern any SOC or honeypot operator can adopt today; the public dataset makes the data reusable for collaborative research.