Intelligent interactive honeypots: A systematization of AI-driven cyber deception

This Systematization of Knowledge (SoK) examines the evolving landscape of intelligent, interactive honeypots, which are deception-based cybersecurity tools that utilize AI/ML to engage attackers proactively. We introduce a novel taxonomy linking interaction levels to Cyber Kill Chain stages and systematically analyze peer-reviewed studies. Our findings expose key design trends, empirical evaluation strategies, and highlight critical research gaps, including scalability, standardization, and dataset diversity. We discuss the roles of LLMs and reinforcement learning, together with the emerging use of federated learning, in advancing honeypot realism and interactivity. This work aims to guide future research in developing adaptive, resilient deception systems for next-generation cyber defense.