A new tool can tell, purely from network traffic, whether a "user" wandering around a honeypot is a real person or a bot going through the motions.
Researchers built PHASE (Passive Human Activity Simulation Evaluation) to grade the behavioral realism of synthetic personas used in cyber ranges, honeypots, and sandboxes. It works entirely passively, analyzing Zeek connection logs collected by a standard network monitoring appliance, with no software installed on the monitored machine. The system distinguishes human from non-human activity with over 90% accuracy, using a novel labeling method built on local DNS records plus SHAP analysis to surface which temporal and behavioral patterns give bots away. In a case study, the team used PHASE to diagnose a synthetic persona's tell-tale non-human patterns, then rebuilt its configuration into something markedly more convincing.
That matters because deception environments are only as good as their illusion. If a synthetic user's traffic looks robotic, an attacker who is paying attention can spot the trap, dodge it, or feed defenders bad intelligence on purpose. Until now, judging whether a fake user "felt human" was mostly an expert gut-check, not a measurement. PHASE turns that judgment call into a testable, repeatable score.
There is a wrinkle worth noting. A system built to passively profile human behavior with no visible instrumentation is, by definition, a surveillance tool. It is currently aimed at bots pretending to be people, but the same passive fingerprinting could just as easily be pointed at real employees who never signed up to be watched.