ShellGames: an LLM-driven speculative SSH deception system

The researchers propose ShellGames, an LLM-driven SSH shell simulator, which uses automatic chain of thought, memory management, speculative command execution, sandbox routing and behavior subversion detection to maintain long-term believable deception. On a standardized benchmark, its command accuracy is 0.898 (+5.3pp), sequence consistency 0.918 (+36pp), state tracking 0.98, and robustness 0.95 (+37pp); a 20-person study shows that the realism of free exploration is close to a real shell, and command coverage is better than traditional honeypots.