WEB DECEPTION FOR WEB APPLICATION SECURITY: FROM LAYERED DEFENSE IMPLEMENTATION TO LLM-ERA ADVERSARY FINGERPRINTING

Abstract

The widespread adoption of internet-based services has propelled web applications to the forefront of modern attack surfaces. Servers handling sensitive user information and transactional operations are now persistent targets, motivating defensive measures that complement, rather than replace, conventional perimeter controls such as web application firewalls. Deception-based security — the deliberate placement of engineered baits that have no legitimate operational use, so that any interaction with them is treated as an intrusion signal — has matured into a complementary defensive layer drawn from the long honeypot tradition. This dissertation investigates the design, implementation, and empirical evaluation of layered web deception against a heterogeneous adversary popu lation that includes a recently-emerged class of attacker: autonomous agents driven by large language models (LLMs). The work proceeds in two phases. Phase I establishes a deception substrate on a MERN-stack electronic-commerce application using four wordlist-style primitives consis tent with established honeypot practice (lure HTML comments carrying fake administra tive URLs, decoy session cookies, off-screen honeypot form fields, and an attempt counter that escalates to a temporary blocking mode). Phase II extends this substrate with two novel semantic-class probes designed to elicit a distinguishable interaction signature from LLM agents: each encodes a non-guessable URL inside page-rendered natural-language content (an HTML comment and an ai-instruction meta tag), so that the URL can be discovered only by an adversary that actually reads the page content rather than by enumerating directory wordlists. A measurement testbed comprising a process-safe trace logger, a probe-identification module, and five adversary harnesses (simulated human shoppers, wordlist scanners, credential-stuffing bots, and LLM-driven agents) is built around the application. Five distinct language models from two vendors (Meta llama-3.1-8b, llama-4-scout-17b, llama 3.3-70b; OpenAI gpt-oss-20b, gpt-oss-120b) are evaluated. Across 285 clean sessions, iv balanced to a uniform n=30 per class (225 sessions in the balanced dataset; A5 retained at its true collected count of n=15 owing to a daily-token cap on the 70B model), the research reports three principal findings within this testbed. First, the contribution is not that every probe fires, but that the semantic probes exhibit selective activation: 0 of 90 non-LLM sessions triggered either probe, while the mean semantic-probe hit rate across the five LLM classes was 70.0 per cent (pooled session-level rate 66.7 per cent, 90 of 135). Second, a Random Forest classifier separates the four super-classes (humans, scanners, credential stuffers, LLM agents) at 100 per cent five-fold cross-validation accuracy, and this accuracy is preserved when all timing features are removed and, separately, when all direct probe-hit features are removed; the joint ablation retains 99.6 per cent accuracy. Third, the observed semantic-probe hit rate increases monotonically with model capabil ity (0, 53, 97, 100, and 100 per cent) when models are sorted by published parameter count, and the gradient is observed across both Meta and OpenAI model families within this testbed. A secondary contribution surfaces a structural placement weakness in the decoy-cookie primitive (P4), whose trigger URL is fetched unconditionally by the front-end on every page mount, producing a 100 per cent observed human false-positive rate; a four-probe subset is shown to attain 84.6 per cent bot true-positive rate at 0 per cent observed human false-positive rate. The legitimate-user baseline is a simulated shopper population generated with Playwright; the false-positive analysis (RQ3) is accordingly scoped to this simulated-user population.