ADLAH
Adaptive multi-layer honeynet architecture for threat behavior analysis via machine learning.
Problem
Classical honeypots often leak their purpose quickly. Once labeled, they yield little about post-exploitation behavior or toolchains. ADLAH asks how layering, adaptation, and consistent telemetry can extend observation windows while keeping deployments reproducible enough for comparative study.
Architecture
Data flows from the exposed edge through nested deception tiers into a normalization and storage path, then into analysis jobs (including ML-based summarization). The diagram is schematic; see the paper and repository for concrete components.
- Exposed edge
- Deception layers
- Telemetry pipeline
- ML analysis
Scientific contribution
The main claim is methodological: treat honeynets as configurable observation instruments with explicit telemetry contracts, and pair them with analysis pipelines (including ML) that preserve traceability back to raw events. The arXiv preprint defines the architecture, motivates design choices, and outlines evaluation dimensions; the repository is the living artifact for implementation details.
Status & artifacts
Paper: arXiv:2512.07827
Code: github.com/JohannesLks/ADLAH
Evaluation: Ongoing -- public notes will document datasets, labeling assumptions, and benchmark comparisons as they stabilize.