Skip to content
Log in
Open access

Explainability-driven adaptive cyber deception control system for autonomous network defense

S. Roy G. Khekare Sejal Chhajed
Aug 2026 · Scientific Reports · Vol 16 · 0 citations · 25 references
Medicine

TL;DR

The presented framework manages to incorporate explainable scoring, convergence of behavior analysis, adaptive control, environment mutation, and reinforcement learning into one cyber deception framework and manages to incorporate all of these features while still preserving transparency and adaptability during the whole process of deception.

Abstract

The increasing sophistication of cyber threats has led to the identification of some major shortcomings associated with honeypots, which include staticness, inflexibility, and vulnerability to fingerprinting. The proposed work aims at overcoming the aforementioned shortcomings by creating an Explainability-Driven Adaptive Cyber Deception Control System capable of engaging in intelligent, interactive interactions with cyber attackers. The key goal of the proposed solution is to improve threat intelligence gathering and deception efficiency by leveraging the benefits of adaptability and explainability. Machine learning, XAI, behavioral profiling, and environment mutation are the four key components that form the backbone of the proposed pipeline system. A Random Forest classifier is used for classification of normal and malicious sessions based on behavioral features at the level of commands. An explainability-driven metric known as the Feature Dominance Deception Index (FDDI) is developed to guide deception approaches, whereas Behavioral Convergence Score (BCS) is considered to assess behavioral convergence of attackers. Intent recognition using kill chain methodology allows generating responses in context-dependent fashion, while the mutation engine creates unique environments in each session to prevent fingerprinting attacks. Furthermore, Reinforcement Learning (RL) layer based on Q-learning is added to the framework to adaptively make decisions by learning the best possible deception tactics over multiple sessions. The Deception Quality Score (DQS) metric is used to measure the quality of deception within each session. Moreover, the UNSW-NB15 network intrusion data set is employed for validating the proposed model. Through benchmarking based on the generated behavioral dataset, the Random Forest-based behavioral profiler yielded a classification accuracy of 90.0%, recall of 85.7%, and an F1-score of 92.3%. Thereafter, the end-to-end deployment of the proposed framework through Cowrie honeypot sessions yielded better deception effectiveness, giving a framework-level attack classification accuracy of 90.0% and a 77.0% improvement in threat intelligence extraction per session than baseline Cowrie deployment. Kill chain stages were identified for the evaluated cases, deception goals were accomplished for all sessions under testing, fingerprinting efforts by the attacker were unsuccessful, and high-quality deception was maintained. The reward per session for the RL agent ranges from + 0 to + 14.0 for different session types, resulting in the formation of a converged Q-table containing values of 21 out of 90 possible states. Additionally, the technique ensures the resistance against honeypot fingerprinting, and demonstrates resistance against evaluated fingerprinting attempts. As far as it is currently known, few previous works can be found which have managed to include explainable scoring, convergence of behavior analysis, adaptive control, environment mutation, and reinforcement learning into one cyber deception framework. The presented framework manages to incorporate all of these features while still preserving transparency and adaptability during the whole process of deception. The research makes advances in the current state-of-the-art research by enabling passive honeypots to become intelligent autonomous systems for detecting cyber threats.

DOI PubMed Semantic Scholar
Read PDF

Similar papers

Open access Jul 2026

AI-Powered Cyber Warfare and the Evolution of Zero Trust Security Architectures in Autonomous Networks

The increasing sophistication of intelligent cyber warfare, in which adversaries exploit artificial intelligence to automate reconnaissance, generate polymorphic malware, and conduct machine-speed attacks, has rendered conventional perimeter security and static Zero Trust implementations inadequate for autonomous and self-managing networks. This study addresses the absence of an integrated, adaptive architecture by designing and analytically evaluating an AI-driven adaptive Zero Trust framework that unifies behavioural analytics, federated intrusion detection, explainable trust scoring, and autonomous policy enforcement within a NIST-aligned model. Adopting a quantitative, experimental, and simulation-based design, the framework was evaluated using public benchmark datasets including CICIDS2017, UNSW NB15, and BoT IoT, with standardised preprocessing, balanced resampling, and stratified cross-validation. Eight classifiers were trained, among which gradient boosting achieved an accuracy and F1 score of approximately 0.9999 on the CICIDS2017 benchmark after leakage-prone identifier features were removed, while ensemble and convolutional models performed strongly. The dynamic trust engine, exercised on an illustrative cohort of ten simulated agents, enforced conservative session-level access decisions, and a simulated three-node federated learning configuration produced an aggregated F1 score of 0.9185, quantifying the privacy-performance trade-off under heterogeneous partitions. These findings support a coherent, identity-centric defence delivering continuous, explainable verification. The study contributes a conceptual architectural blueprint validated through simulation rather than an operationally deployed system, and sampled datasets and simulated agents constrain operational generalization, motivating future validation on live autonomous network testbeds.

Utin Nyimeobong Archibong, Suleiman S. Abba, Busola Motunrayo Olawale et al. · 0 citations
Open access Jul 2026

A Deception-Based Intrusion Prevention Framework for Proactive Network Security Using Behavioral Threat Analysis

Experimental evaluation conducted in a controlled network environment demonstrates that the proposed Deceptive Intrusion Prevention System improves detection accuracy, reduces false positives, and enhances overall system resilience.

Priyanka Tuppad, Vinit Kumar Shukla · 0 citations
Conference Jul 2026

Chameleon: A Deception Defense Strategy Against LLM-Assisted Attacker in New Power Systems

As new power systems become increasingly dependent on cloud-supported cyber-physical systems, their openness and interconnectivity continue to increase, thereby exposing risk points for advanced persistent threats (APTs). Deception defense has been widely regarded as an effective proactive approach for mitigating APT threats. However, the remarkable reasoning capabilities of large language models (LLMs) have enabled APT attackers to leverage LLM-based semantic understanding and task-planning capabilities to conduct automated, intelligent penetration attacks, while also bringing new challenges for traditional deception defense mechanisms. To address this issue, we propose a Chameleon service mechanism that constructs multiple types of LLM-oriented deceptive services based on the shared characteristics that LLMs exhibit during environment reconnaissance and target screening, and further incorporates an attack-defense game model with Minimax Q-learning for deployment. In this way, the proposed method increases the likelihood of trapping attackers while minimizing interference with normal power operations. The experimental results show that the proposed Chameleon service mechanism can effectively enhance the trapping effect of deceptive services on LLM-assisted attackers and demonstrate good effectiveness and stability across different candidate scales and LLM evaluation conditions. Our method can provide a feasible solution for proactive deception defense against intelligent attackers in new power systems.

Ying Yao, Yiji Lin, Qinglin Yang et al. · 0 citations
Open access Jul 2026

Unveiling hidden adversaries - detecting command & control servers

The increasingly advanced forms of cyber-attacks have highlighted the importance of advanced threat hunting as a necessary skillset. The current research examines the effectiveness of using Elasticsearch, Kibana, and Lucene for an intelligence-driven threat hunting to identify attack infrastructure or a Command & Control (C2) server. By aggregating all system traffic logs and security artifacts into a single data lake/warehouse, organizations are able to leverage centralized analysis of information from different sources on a corporate scale. Utilizing Kibana’s ability to perform network and log analysis, using Lucene’s rich syntax to make sophisticated queries will empower individuals to make valuable findings from log and network traffic logs that identify behaviours and patterns typical of C2 activities. A novel intelligence-based threat hunting approach is presented here that utilizes Elasticsearch, with domain-specific language additions to refine search queries and investigate for C2 related activity. A detailed analysis of the research based on real-world datasets is conducted to evaluation the threat hunting framework’s abilities in detecting C2 servers and minimize true/false positives in relation to organizational security concerns.

N. Alsharabi, Akashdeep Bhardwaj, Amr Jadi et al. · 0 citations
Open access Jul 2026

Explainable AI-Based Cyber Threat Detection Framework Using LSTM and Autoencoder for Intelligent Network Security

The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.

Indu Asitha, M. N. · 0 citations