| Paper Abstract and Keywords |
| Presentation |
2026-07-15 09:15
Observation and Analysis of Cyberattacks Targeting Self-Hosted LLM Servers Kanta Okugawa (NICT/Ritsumeikan University), Daisuke Makita, Masaki Kubo (NICT), Koichi Mouri (Ritsumeikan University/NICT), Takahiro Kasama (NICT) ISEC2026-54 SITE2026-50 BioX2026-77 HWS2026-50 ICSS2026-69 EMM2026-61 |
| Abstract |
(in Japanese) |
(See Japanese page) |
| (in English) |
As the practical application of large language models (LLMs) advances rapidly, the use of local LLMs—where organizations and individuals operate their own LLM servers using self-hosted inference platforms such as Ollama, in addition to cloud-based services—is on the rise. However, there have been confirmed cases where LLM servers set up for development and testing purposes have been unintentionally exposed to the internet due to configuration errors or a lack of authentication, and the risks associated with using local LLMs have not yet been fully elucidated. Therefore, this study aims to clarify the actual state of attacks against local LLMs by observing and analyzing cyberattacks targeting self-hosted LLM servers. We investigated the attack surface of existing local LLMs and conducted observations using a simple honeypot listening on all ports and a newly developed low-interaction honeypot that simulates the responses of an LLM server. The results demonstrated that using a low-interaction honeypot allows for the collection of prompt text sent to inference APIs, and that the attacker’s intent can be classified and analyzed based on the observed prompts. |
| Keyword |
(in Japanese) |
(See Japanese page) |
| (in English) |
Self-Hosted LLM Server / Honeypot / Prompt Analysis / / / / / |
| Reference Info. |
IEICE Tech. Rep., vol. 126, no. 111, ICSS2026-69, pp. 282-289, July 2026. |
| Paper # |
ICSS2026-69 |
| Date of Issue |
2026-07-06 (ISEC, SITE, BioX, HWS, ICSS, EMM) |
| ISSN |
Online edition: ISSN 2432-6380 |
Copyright and reproduction |
All rights are reserved and no part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any information storage and retrieval system, without permission in writing from the publisher. Notwithstanding, instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. (License No.: 10GA0019/12GB0052/13GB0056/17GB0034/18GB0034) |
| Download PDF |
ISEC2026-54 SITE2026-50 BioX2026-77 HWS2026-50 ICSS2026-69 EMM2026-61 |
| Conference Information |
| Committee |
BioX HWS ISEC SITE ICSS EMM IPSJ-CSEC IPSJ-SPT |
| Conference Date |
2026-07-13 - 2026-07-15 |
| Place (in Japanese) |
(See Japanese page) |
| Place (in English) |
Sapporo Convention Center |
| Topics (in Japanese) |
(See Japanese page) |
| Topics (in English) |
|
| Paper Information |
| Registration To |
ICSS |
| Conference Code |
2026-07-BioX-HWS-ISEC-SITE-ICSS-EMM-CSEC-SPT-SEC |
| Language |
Japanese |
| Title (in Japanese) |
(See Japanese page) |
| Sub Title (in Japanese) |
(See Japanese page) |
| Title (in English) |
Observation and Analysis of Cyberattacks Targeting Self-Hosted LLM Servers |
| Sub Title (in English) |
|
| Keyword(1) |
Self-Hosted LLM Server |
| Keyword(2) |
Honeypot |
| Keyword(3) |
Prompt Analysis |
| Keyword(4) |
|
| Keyword(5) |
|
| Keyword(6) |
|
| Keyword(7) |
|
| Keyword(8) |
|
| 1st Author's Name |
Kanta Okugawa |
| 1st Author's Affiliation |
National Institute of Information and Communications Technology/Ritsumeikan University (NICT/Ritsumeikan University) |
| 2nd Author's Name |
Daisuke Makita |
| 2nd Author's Affiliation |
National Institute of Information and Communications Technology (NICT) |
| 3rd Author's Name |
Masaki Kubo |
| 3rd Author's Affiliation |
National Institute of Information and Communications Technology (NICT) |
| 4th Author's Name |
Koichi Mouri |
| 4th Author's Affiliation |
Ritsumeikan University/National Institute of Information and Communications Technology (Ritsumeikan University/NICT) |
| 5th Author's Name |
Takahiro Kasama |
| 5th Author's Affiliation |
National Institute of Information and Communications Technology (NICT) |
| 6th Author's Name |
|
| 6th Author's Affiliation |
() |
| 7th Author's Name |
|
| 7th Author's Affiliation |
() |
| 8th Author's Name |
|
| 8th Author's Affiliation |
() |
| 9th Author's Name |
|
| 9th Author's Affiliation |
() |
| 10th Author's Name |
|
| 10th Author's Affiliation |
() |
| 11th Author's Name |
|
| 11th Author's Affiliation |
() |
| 12th Author's Name |
|
| 12th Author's Affiliation |
() |
| 13th Author's Name |
|
| 13th Author's Affiliation |
() |
| 14th Author's Name |
|
| 14th Author's Affiliation |
() |
| 15th Author's Name |
|
| 15th Author's Affiliation |
() |
| 16th Author's Name |
|
| 16th Author's Affiliation |
() |
| 17th Author's Name |
|
| 17th Author's Affiliation |
() |
| 18th Author's Name |
|
| 18th Author's Affiliation |
() |
| 19th Author's Name |
|
| 19th Author's Affiliation |
() |
| 20th Author's Name |
|
| 20th Author's Affiliation |
() |
| 21st Author's Name |
|
| 21st Author's Affiliation |
() |
| 22nd Author's Name |
|
| 22nd Author's Affiliation |
() |
| 23rd Author's Name |
|
| 23rd Author's Affiliation |
() |
| 24th Author's Name |
|
| 24th Author's Affiliation |
() |
| 25th Author's Name |
|
| 25th Author's Affiliation |
() |
| 26th Author's Name |
/ / |
| 26th Author's Affiliation |
()
() |
| 27th Author's Name |
/ / |
| 27th Author's Affiliation |
()
() |
| 28th Author's Name |
/ / |
| 28th Author's Affiliation |
()
() |
| 29th Author's Name |
/ / |
| 29th Author's Affiliation |
()
() |
| 30th Author's Name |
/ / |
| 30th Author's Affiliation |
()
() |
| 31st Author's Name |
/ / |
| 31st Author's Affiliation |
()
() |
| 32nd Author's Name |
/ / |
| 32nd Author's Affiliation |
()
() |
| 33rd Author's Name |
/ / |
| 33rd Author's Affiliation |
()
() |
| 34th Author's Name |
/ / |
| 34th Author's Affiliation |
()
() |
| 35th Author's Name |
/ / |
| 35th Author's Affiliation |
()
() |
| 36th Author's Name |
/ / |
| 36th Author's Affiliation |
()
() |
| Speaker |
Author-1 |
| Date Time |
2026-07-15 09:15:00 |
| Presentation Time |
25 minutes |
| Registration for |
ICSS |
| Paper # |
ISEC2026-54, SITE2026-50, BioX2026-77, HWS2026-50, ICSS2026-69, EMM2026-61 |
| Volume (vol) |
vol.126 |
| Number (no) |
no.107(ISEC), no.108(SITE), no.109(BioX), no.110(HWS), no.111(ICSS), no.112(EMM) |
| Page |
pp.282-289 |
| #Pages |
8 |
| Date of Issue |
2026-07-06 (ISEC, SITE, BioX, HWS, ICSS, EMM) |