CASSANDRA: Closed-Loop AI-Native Cyber Defense via Deception-Driven Active Sensing, Temporal Graph Intelligence, and Policy-Verified Autonomy for Cloud/IAM Environments

Abstract

Cloud and identity-centered attacks increasingly blend into legitimate administration through credential theft, token replay, delegated-role misuse, and control-plane API abuse. This paper presents CASSANDRA, a closed-loop cyber-defense framework that treats deception as an active sensing action rather than a static trap. The framework maintains a belief distribution over competing cloud and identity attack narratives on a temporal enterprise graph, selects a deception action according to expected information gain and operational cost, and subjects every candidate action to deterministic policy checks before execution. This revision makes the decision process explicit by defining the action and observation spaces, Bayesian update, information-gain objective, measurable safety budgets, stopping rule, and policy-verification procedure. We provide pseudocode, a structured threat model, and reproducibility materials accompanying this article with fixed configurations, source code, raw outputs, integrity checksums, and bootstrap confidence intervals. Across four author-defined scenarios and 160,000 simulated runs, full CASSANDRA achieved scenario-level accuracy from 0.909 to 0.993 and mean evidence gain from 0.110 to 0.266; the policy shield prevented all synthetically proposed unsafe executions, whereas the no-shield variant executed approximately 8% of such proposals. These results demonstrate controlled methodological behavior only and are not presented as production, public-dataset, or red-team validation. A reduced, technique-specific cloud/IAM scenario library illustrates how hypotheses, signals, probes, and bounded responses are instantiated without the repetitive catalogue structure of the original submission.