SAGE: An Adaptive IoT Honeypot with FSM-Driven Protocol Emulation and GraphRAG-Powered Response Generation

Increasing security threats in Internet of Things (IoT) ecosystems necessitate advanced deception mechanisms that can engage adversaries and generate realistic interactions. Traditional IoT honeypots suffer from limited protocol emulation, static response mechanisms, and susceptibility to fingerprinting, making them ineffective against sophisticated attacks. To address these challenges, this paper introduces SAGE (State-Aware Graph-Enhanced Honeypot), an adaptive IoT honeypot that integrates Finite-State Machine (FSM)-driven protocol emulation with GraphRAG-enhanced retrieval. Unlike conventional honeypots, SAGE dynamically models stateful IoT protocols, ensuring structured and realistic request-response interactions. For undefined requests, GraphRAG retrieval selects relevant protocol knowledge from knowledge graphs and integrates it with FSM-derived contextual information, enabling the Large Language Model (LLM) to generate coherent and deception-resilient responses. Additionally, a fact-checking engine and feedback mechanism refine responses, mitigating hallucinations and ensuring protocol fidelity. A key feature of SAGE is its ability to create an IoT honeypot with limited protocol knowledge while progressively evolving its emulation depth by dynamically expanding its state-response mappings based on observed adversarial interactions. Experimental evaluation demonstrates that SAGE enhances deception robustness, improves adversary engagement, and mitigates honeypot fingerprinting risks. By combining FSM-based protocol modeling, GraphRAG-enhanced retrieval, and adaptive LLM-generated responses, SAGE establishes a scalable, intelligence-driven security framework that significantly advances IoT honeypot technology.