Towards Log Analysis with AI Agents: Cowrie Case Study

Enis Karaarslan, Esin Güler, Efe Emir Yüce, Cagatay Coban
8/22/2025
cs.CRcs.AIcs.MA

No confident code implementation found for this paper. 2 possible matches can be shown below.

Abstract

The scarcity of real-world attack data significantly hinders progress in cybersecurity research and education. Although honeypots like Cowrie effectively collect live threat intelligence, they generate overwhelming volumes of unstructured and heterogeneous logs, rendering manual analysis impractical. As a first step in our project on secure and efficient AI automation, this study explores the use of AI agents for automated log analysis. We present a lightweight and automated approach to process Cowrie honeypot logs. Our approach leverages AI agents to intelligently parse, summarize, and extract insights from raw data, while also considering the security implications of deploying such an autonomous system. Preliminary results demonstrate the pipeline's effectiveness in reducing manual effort and identifying attack patterns, paving the way for more advanced autonomous cybersecurity analysis in future work.

View on arXivView PDF

Code Implementations

No confident code match yet

We couldn't find an author-owned or strongly-evidenced community implementation for this paper. 2 weaker matches are hidden by default — verify before relying on them.

No code implementations found yet.

Know of an implementation? Let us know in the comments below!

Similar Papers

Cite this paper

@article{karaarslan2025towards,
  title  = {Towards Log Analysis with AI Agents: Cowrie Case Study},
  author = {Enis Karaarslan and Esin Güler and Efe Emir Yüce and Cagatay Coban},
  year   = {2025},
  eprint = {2509.05306},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2509.05306v1}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2509.05306.svg)](https://codeofpaper.com/paper/2509.05306)

Discussion