OHRA: dynamic multi-protocol LLM-based cyber deception

Honeypots aid cyber defense but traditional designs demand heavy manual setup and support few protocols. We introduce OHRA, a modular, extensible LLM-driven honeypot that supports multiple protocols (SSH, Telnet, HTTP, FTP, SMTP, SNMP, IPP) and can integrate different LLM providers. OHRA wraps the model with session memory and prompt control to generate realistic, context-aware responses with less configuration effort. We evaluate OHRA against Cowrie and a recent LLM-based honeypot using curated malware commands and a real-world Internet deployment. OHRA is among the first honeypots to demonstrate a unified LLM-based architecture across several protocols: SSH, Telnet, and HTTP are fully interactive, while FTP, SMTP, IPP, and SNMP are currently implemented in partial form. Results show higher response realism, improved session handling, and greater deceptiveness in comparison to prior systems. This work lays the groundwork for scalable and adaptive multi-protocol deception platforms.