Deutsche Telekom

Solution

Deutsche Telekom uses its T-Pot honeypot platform to run AI-enhanced decoys that keep attackers engaged longer without exposing real production systems. Within T-Pot, the honeypots Galah and Beelzebub use Large Language Models (LLM) to generate dynamic responses instead of the repetitive, generic feedback typical of low-interaction traps. Galah handles web requests as a specialized chatbot that makes an attacker believe actions are changing the target system, while Beelzebub applies the same idea to protocol interactions such as SSH sessions and returns convincing but useless data. T-Pot acts as the umbrella platform that packages these honeypots, while the recorded interaction history is stored as a list for defenders to analyze attacker tactics, techniques, and tools. The design aims to approximate medium- or high-interaction realism with lower operational effort and lower exposure than traditional high-interaction honeypots.

Data flow

Attacker inputs such as web requests and protocol sessions enter T-Pot through Galah and Beelzebub. These honeypots use LLM-driven response generation to return realistic outputs that appear to reflect attacker actions. The resulting interaction trail is then recorded in a list for Deutsche Telekom to analyze attacker tactics, while the attacker remains isolated from real systems.