ShellGames: Speculative LLM-Driven SSH Deception

How it works

The summary names ShellGames' five components; the page gives the pipeline and the mechanism behind each, which is what an engineer evaluating the design needs.

An input command hits the Smart Router first. Routing is blocklist-based: commands known to need interactivity or runtime-dependent semantics (nano, wget) are delegated to a sandboxed backend shell; everything else goes to the Memory Manager. The backend is isolated but transparently synchronized with simulated state — filesystem side effects are reflected back — so executed and simulated interactions stay coherent.

The Memory Manager externalizes state into two structures: a virtual filesystem tree and a pruned command history. Both are maintained by an asynchronous background synthesis job that (i) parses state-changing commands to update the filesystem tree and (ii) prunes non-state-changing commands and filesystem ops already captured by the tree. This keeps state maintenance off the critical response path and keeps the Generator's context compact (which also lowers inference latency).

The Generator conditions an LLM on the system definition (initial prompt encoding host config + behavior), the pruned history, and the virtual filesystem, using Auto-CoT + few-shot.

The Speculative Execution Engine is the notable design choice: a lightweight prediction model trained on shell interaction traces produces top-k likely follow-up commands from recent history; multiple Generator instances precompute their responses in parallel and cache them. A cache hit returns instantly, bypassing the Generator. Wrong predictions are silently discarded (no state effect); any state-changing command invalidates the cache and triggers a new speculation pass — this is the correctness hinge.

The Post-Processor does subversion detection via a transformer-based classifier over both input command and generated output, exploiting the constrained shell input/output domain (unlike unbounded general-purpose LLM prompt-injection detection). On detection it returns a shell-compliant error.

Preconditions / scope

The threat model is explicitly post-compromise: it assumes the adversary already has shell access and does not address intrusion prevention or authentication. It assumes the adversary is unaware ShellGames is present, but may adapt to observed responses. Positioned against Cowrie (medium-interaction) and full-system high-interaction honeypots.

What to do

Code/dataset released (anonymized for submission): https://anonymous.4open.science/r/repo_sub_MTD-4874/. Note the paper is arXiv 2606.17986v1, dated June 2026 — a preprint, results not independently reproduced.

Caveats

The realism/coverage claims rest on a 20-participant user study — the authors themselves call it "small-scale." Implementation details are deferred to an appendix not included in the fetched text (e.g., which LLM backs the Generator, the prediction model's architecture, and blocklist contents are unstated here).