Antonio Lara

@article{Lara2026d,

title = {GenPot: A generative honeypot architecture for adaptive web and API interaction},

author = {Antonio Lara-Gutierrez and Juan Zamorano and Jose A. Onieva},

url = {/wp-content/papers/Lara2026d.pdf},

doi = {10.1007/s10489-026-07442-4},

issn = {1573-7497},

year  = {2026},

date = {2026-09-11},

urldate = {2026-09-11},

journal = {Applied Intelligence},

volume = {56},

number = {419},

abstract = {Honeypots are widely used as cyber-deception tools to study adversarial behaviour, yet their effectiveness is limited by a trade-off between realism and security risk. Low-interaction honeypots are easily detected, while high-interaction honeypots provide realistic data at the cost of network exposure. Recent advances suggest that Large Language Models (LLMs) can mitigate this trade-off by dynamically generating convincing outputs without requiring a vulnerable backend. In this paper, we present GenPot, a fine-tuned LLM-powered honeypot that integrates command-line, API, and dynamic web interaction to deliver realistic yet non-compromisable environments. Our approach combines supervised fine-tuning with prompt engineering, cybersecurity safeguards, and state management to simulate consistent and realistic system responses. As a proof-of-concept use case, we implement the system on top of an OpenCanary baseline simulating a Synology NAS device. To rigorously assess the framework, we conducted an exhaustive multi-dimensional evaluation encompassing deep semantic fidelity, inference latency, high-concurrency scalability, and operational energy efficiency (RPS/W). Technical results demonstrate that the optimized architecture sustains over 1,000 requests per second with near-perfect structural validity, while token-level guardrails ensure high resilience against prompt injection attacks. Crucially, we validate the system’s practical deception efficacy through a 14-day in-the-wild deployment and a human-in-the-loop credibility assessment, where experts were unable to distinguish the honeypot from a physical device (45% accuracy). Furthermore, the framework’s generalizability is proven via a rapid adaptation to a medical Fast Healthcare Interoperability Resources (FHIR) API. This work advances the current state of LLM-powered honeypots by demonstrating a reproducible, highly scalable, energy-aware, and credible approach for adaptive cyber deception.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Lara2026c,

title = {Towards maintainable AI-driven network anomaly and threat detection: a comparative analysis of datasets, preprocessing techniques, and model trade-offs},

author = {Antonio Lara-Gutierrez and Carmen Fernandez-Gago and Jose A. Onieva},

url = {/wp-content/papers/Lara2026c.pdf},

doi = {10.1007/s10462-026-11667-7},

issn = {1573-7462},

year  = {2026},

date = {2026-08-04},

urldate = {2026-08-04},

journal = {Artificial Intelligence Review},

abstract = {As the integration of Artificial Intelligence into network intrusion detection systems matures, a critical gap remains in the rigorous empirical benchmarking of datasets, preprocessing techniques, and model effectiveness. This article presents a comparative experimental study of anomaly and threat detection techniques used in network analysis through a multistep pipeline. First, we perform a structured comparison and Exploratory Data Analysis of the most commonly used network security datasets to quantitatively assess their balance, diversity, and real-world representativeness. Subsequently, we experimentally evaluate the performance of distinct Machine Learning, Deep Learning, and Hybrid Models derived under standardized preprocessing techniques to determine the most effective combinations for specific attack vectors. Our results demonstrate that hybrid architectures achieve superior generalisation, yet face challenges regarding computational overhead and cross-dataset adaptability. Addressing these limitations, we propose a proof-of-concept adaptive architecture designed to handle concept drift and adversarial threats. Finally, we outline a roadmap for future research, emphasizing the necessity of dynamic, verifiable AI-driven systems that operate reliably in evolving cybersecurity environments.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Lara2026b,

title = {Adversarial red teaming and imbalance correction in heterogeneous NIDS: A class-specific adaptive GAN framework},

author = {Antonio Lara-Gutierrez and Carmen Fernandez-Gago and Jose A. Onieva},

url = {/wp-content/papers/Lara2026b.pdf},

doi = {10.1016/j.jisa.2026.104584},

issn = {2214-2126},

year  = {2026},

date = {2026-07-20},

urldate = {2026-07-20},

journal = {Journal of Information Security and Applications},

volume = {102},

pages = {104584},

abstract = {Modern network infrastructures face a structural long-tail imbalance where malicious events are statistically negligible against benign traffic. This bias causes Machine Learning-based Network Intrusion Detection Systems (NIDS) to systematically overlook rare, high-severity intrusions. While Generative Adversarial Networks (GANs) offer a solution for minority class synthesis, standard monolithic architectures suffer from majority-class gradient dominance, inevitably leading to conditional mode collapse. To address this, we propose the Adaptive Manifold-Decoupled GAN (AMD-GAN), a novel framework that applies class-wise architectural decoupling to feature manifolds and dynamically adapts its optimization regime to each category’s cardinality. This decoupled design mitigates inter-class interference and empirically reduces critic memorization. Evaluated across three heterogeneous NIDS benchmarks (CIC-IDS2017, UNSW-NB15, Edge-IIoTset 2022), AMD-GAN achieves a mean global empirical Wasserstein distance of W1=0.009±0.001 (across five independent seeds), confirming robust distributional fidelity. Under a Train-Synthetic-Test-Real (TSTR) protocol, balanced synthetic augmentation consistently improves Multiclass Macro F1-Scores. Specifically, in CIC-IDS2017, it yields a 10.1 pp absolute improvement (+45.2% Botnet, +22.9% Web Attack), demonstrating statistically significant superiority over interpolation methods like ADASYN and Borderline-SMOTE. An extensive ablation study isolates the adaptive engine as the causal driver of manifold recovery, while Distance to Closest Record (DCR) analysis confirms the absence of exact-match memorization. Furthermore, interpretability techniques (SHAP and LIME) validate that the generated flows preserve authentic protocol semantics, enabling unambiguous attribution for Security Operations Centers (SOC). Deployed offensively as an automated Red Teaming engine, AMD-GAN exposes structural fragility in operational tree ensembles, inducing up to 0.909 Macro F1-Score degradation under volumetric stress scenarios. Finally, the decoupled sequential training architecture restricts peak GPU VRAM to 1,575 MB while generating 90,000 synthetic flows in 15.7 s, establishing AMD-GAN as a computationally efficient, low-VRAM solution potentially suitable for resource-constrained deployments for robust data augmentation and adversarial NIDS auditing.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{Lara2025,

title = {A Framework for Drift Detection and Adaptation in AI-driven Anomaly and Threat Detection Systems},

author = {Antonio Lara-Gutierrez and Carmen Fernandez-Gago and Jose A. Onieva },

editor = {Massimiliano Albanese },

url = {/wp-content/papers/Lara2025.pdf},

doi = {10.1007/s10207-025-01118-9},

isbn = {1615-5270},

year  = {2025},

date = {2025-09-02},

urldate = {2025-09-02},

journal = {International Journal of Information Security},

volume = {24},

number = {199},

abstract = {The dynamic and evolving nature of cybersecurity threats presents significant challenges to anomaly and threat detectionsystems, particularly those that rely on Artificial Intelligence (AI) as their detection engine. A key limitation of current AImodels is their inability to adapt to concept drift, feature drift, and adversarial attacks, which degrade performance over time.Although these phenomena arise from different underlying processes, they all share the effect of misaligning the operationaldata with the model’s training data. This study introduces the Hybrid Drift Detection and Adaptation Framework (HDDAF),which is a multi-layered AI system that is specifically designed to mitigate concept drift, feature drift, and adversarial attacksin cybersecurity. By framing all three challenges, HDDAF provides a unified approach that detects and responds to bothnatural evolution and malicious manipulation within a single adaptive pipeline. HDDAF integrates Hoeffding drift detection,feature selection, adversarial training, and incremental learning, allowing it to dynamically adapt through a Mixed-DriftHandling Module, which balances fine-tuning and full retraining. On the CIC-IDS2017 dataset, HDDAF achieves a macroF1 score above 99% and in tests on related datasets, it consistently adapts to data shifts with minimal retraining. An ablationstudy confirms that each module contributes to overall robustness, and real-time simulations demonstrate its ability to processhigh-velocity streams with stable latency and resource use. HDDAF’s hybrid design delivers both high accuracy and scalableperformance for real-world cybersecurity applications.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}