A Honeypot That Improvises Every Response

What it does

Galah is a Go-based web honeypot that outsources its acting skills to a large language model. Rather than shipping hand-crafted emulators for specific apps, it feeds each incoming HTTP request to an LLM and asks it to generate believable headers and body content on the spot. Replies are cached per-port to avoid burning API credits on repeat probes, and every interaction is logged as structured JSON.

The interesting bit

The project embraces improvisation over perfection. The README candidly warns that slow responses and non-standard behavior can fingerprint the honeypot, which is a refreshingly honest admission for a security tool. It also layers optional Suricata rule matching on top of the generative responses, pairing traditional IDS signatures with LLM-powered deception.

Key highlights

• Supports OpenAI, GoogleAI, Vertex AI, Anthropic, Cohere, and Ollama.
• Port-specific response caching to cut duplicate LLM API calls.
• Optional Suricata HTTP rule inspection (with limited PCRE support).
• Usable as a standalone Go library via galah.Service and GenerateHTTPResponse.
• Structured JSON event logs capturing requests, responses, and rule matches.

Caveats

• The honeypot may be identifiable through network fingerprinting, prolonged response times, and non-standard responses.
• Suricata rule matching does not support all keywords and has limited PCRE handling.
• The author warns of “Denial of Wallet” attacks if you forget to set LLM API usage limits.

Verdict

A fun experiment for researchers who want an adaptive decoy without maintaining a pile of static emulators. If you need a stealthy, production-grade trap for sophisticated adversaries, look elsewhere.