HYDRA × PDX¶

Dual-use cybersecurity pipeline — LLM-powered honeypot meets security training data generator.

The problem¶

In cybersecurity, a honeypot is a fake server deliberately exposed on the internet to attract attackers. You let them in, watch what they do, and learn from their techniques.

The problem is that today's honeypots are trivially detectable. An experienced attacker runs uname -r and sees the wrong kernel. Or checks /proc/1/cgroup and spots Docker traces. Tools like Cowrie — the most popular SSH honeypot — get fingerprinted in under 30 seconds.

Result: attackers disconnect instantly. Your logs are noise, not intelligence.

The hypothesis¶

What if the terminal could intelligently answer any command an attacker types — in real time, with memory, and without leaving any trace that it's fake?

And what if the captured data could automatically produce both offensive and defensive training datasets — from the same raw events?

That's what HYDRA × PDX does.

How it works¶

graph TB
    A[Attacker via SSH] --> B[HYDRA Honeypot]
    P[Pentester via Burp] --> C[Burp Extension]
    B --> D[DataRouter]
    C --> D
    D --> E[Defensive stream]
    D --> F[Offensive stream]
    D --> G[Combined ReAct]
    E --> H[Fine-tuning
Unsloth / LoRA]
    F --> H
    G --> H
    H --> |feedback.yaml| B

The system has two data sources:

Both sources produce events in the same .pdx format. Both converge into a single DataRouter that classifies each event into defensive, offensive, or both streams simultaneously.

Key numbers¶

What's in the docs¶

Links¶

• GitHub repository
• arXiv paper (coming soon)
• LinkedIn