HydraPoT: A Configurable Multi-Agent Framework for Cost-Aware LLM-Assisted Honeypots

Abstract

Large language models (LLMs) can improve honeypot realism by generating dynamic, context-aware responses, but powerful cloud models incur substantial cost and latency, while lightweight models may provide weaker deception. This forces practitioners to choose between operational efficiency and interaction fidelity. In this work, we present HydraPoT, a configurable multi-agent honeypot framework that integrates traditional emulation, lightweight LLMs, and powerful cloud LLMs. HydraPoT routes each attacker command to an appropriate agent according to a configurable complexity-based policy, while maintaining shared session state to preserve consistency across agent transitions. We evaluate HydraPoT through an architectural-overhead analysis, a cross-agent context-preservation benchmark, and a three-agent case study. HydraPoT introduces less than 5% runtime overhead, preserves context across heterogeneous agents, and achieves fidelity close to a cloud-LLM-only honeypot. Under our case-study policy, it reduces cloud-processed tokens by 72.6% and operational cost by 3.7x. These results demonstrate that configurable multi-agent routing can make realistic LLM-assisted honeypots more practical under limited operational budgets.