Abstract
Large Language Model (LLM)-driven Secure Shell (SSH) honeypots have rapidly displaced static, templated decoys, yet they share a structural limitation: a single model and a single policy serve every turn of an intrusion, from low-stakes reconnaissance to high-value persistence. This review asks whether honeypots can instead adapt their inference to the attacker’s phase. We conduct a Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020-guided systematic mapping review of fifty influential studies (2020–2026) drawn from three strands—honeypots and generative deception, cost-aware model routing and mixture-of-experts inference, and LLM agents, embeddings, and retrieval-augmented generation in security operations—assembled under a disclosed, purposive top-50 prioritization ranked by age-normalized citation velocity. That prioritization is a deliberate mapping strategy: it surfaces the field’s most influential work rather than claiming exhaustive coverage, and a sensitivity analysis tests how robust the conclusions are to the cap. Three findings emerge. Across the reviewed literature, honeypot adaptivity has advanced at the policy and generation layers but not at the inference-allocation layer; the routing literature has solved capacity allocation but conditions only on query-intrinsic signals, not on adversarial session phase; and embedding-based analytics, corroborated by a production deployment, show the phase signal is observable and reliable. The strands are individually mature and mutually disconnected. We formalize this gap and propose a phase-adaptive, agent-oriented framework that pairs an embedding-based phase estimator and an O(1) phase-to-model dispatch layer with an unprivileged, campaign-level observation substrate.The review contributes a reproducible corpus, an age-normalized bibliometric ranking, a formal gap analysis, and a conceptual architecture that operationalizes the maturation arc from static to phase-adaptive honeypots.