EvilTwin: A Tiered, Cost-Aware SSH Deception Gateway with Real-Time Connection Routing, Ensemble Classification, and Large Language Model Arbitration

This paper presents EvilTwin, an intelligent SSH deception gateway that classifies incoming connections in real time and transparently routes them either to a protected production server or to a honeypot decoy. The system employs a four-tier cost-aware decision pipeline consisting of behavioral heuristics, a machine-learning ensemble, an arbitration layer, and a large language model arbiter for ambiguous cases. The platform integrates Cowrie and Dionaea honeypots, threat intelligence enrichment, canary tokens, and a Security Operations Center dashboard. EvilTwin is designed to improve attacker visibility while minimizing risk to production infrastructure through proactive cyber deception techniques.