mrheinen / lophiid

A distributed honeypot for monitoring large scale web attacks
GNU General Public License v2.0
6 stars 1 forks source link

Refactor LLM lookups: concurrent LLM lookups #71

Closed mrheinen closed 2 days ago

mrheinen commented 2 days ago

Right now the command injection sends a whole command injection string to the LLM (e.g. echo ssdsda;echo RESULT=0). The LLMs I tested don't always successfully split a string of multiple commands. Additionally it's hard to control the size of the output per command and that can result in one command output to consume all tokens.

The upcoming change will make Lophiid split the command string and call the LLM separately for each command. This is slow with the old code since that only calls the LLM serially so we need to refactor that and allow concurrent LLM calls.