The Lying Honeypot: An AI-Driven Cyber Deception Framework for Behavioral Threat Intelligence and Attacker Profiling

Abstract

With the evolution of cyber threats, they have become more sophisticated, adaptive, and capable of evading traditional cybersecurity measures, including signature-based intrusion detection systems, firewalls, and standard honeypots. This has led to the development of a growing suite of intelligent cyber deception tools that can be proactively used to engage attackers and collect threat intelligence. The lying honeypot is an AI-based cyber deception framework that enhances the way an attacker interacts with a deception environment, analyzes the attacker’s behavior, and collects forensic information in real-time. The framework involves incorporating adaptive deception techniques, AI-based interactive terminal environments, device fingerprinting, geolocation analysis, behavioral threat classification, and real-time monitoring at a centralized location to create a comprehensive cybersecurity framework. The proposed framework offers flexibility in simulating realistic operating environments (OE) and, therefore, provides a more realistic deception and extends the engagement time of attackers. Multiple attack scenarios with both automated bots, low-skill attackers, and advanced exploratory behaviors were experimentally performed. The results showed good attacker engagement, responsiveness of the real-time system, and successful collection of forensic intelligence. The framework was able to correctly classify behavior with an accuracy of 91.2%, accurately fingerprint devices with an accuracy of 94.6%, and the average attacker engagement duration was 8.4 min. The findings demonstrate that the use of artificial intelligence together with adaptive cyber deception methods increases the effectiveness of modern honeypot systems to support proactive threat intelligence and behavioral cybersecurity analysis.