Explainability-driven adaptive cyber deception control system for autonomous network defense

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Machine Learning

Background:

• Traditional honeypots suffer from staticness, inflexibility, and vulnerability to fingerprinting.
• Sophisticated cyber threats necessitate more dynamic and intelligent defense mechanisms.
• Existing systems lack adaptability and explainability in deception strategies.

Purpose of the Study:

• To develop an Explainability-Driven Adaptive Cyber Deception Control System.
• To enhance threat intelligence gathering and deception efficiency.
• To overcome the limitations of traditional static honeypots.

Main Methods:

• Utilized machine learning, explainable AI (XAI), behavioral profiling, and environment mutation.
• Implemented a Random Forest classifier for session classification.
• Incorporated Feature Dominance Deception Index (FDDI) and Behavioral Convergence Score (BCS) for explainability and analysis.
• Integrated Reinforcement Learning (RL) with Q-learning for adaptive decision-making.
• Employed kill chain methodology for intent recognition and context-aware responses.
• Developed a mutation engine for environment variability to prevent fingerprinting.

Main Results:

• Achieved 90.0% classification accuracy, 85.7% recall, and 92.3% F1-score for behavioral profiling on the UNSW-NB15 dataset.
• Demonstrated a 77.0% improvement in threat intelligence extraction per session compared to baseline Cowrie honeypot.
• Confirmed successful accomplishment of deception goals and resistance against fingerprinting attempts.
• RL agent achieved rewards ranging from 0 to 14.0, with a converged Q-table indicating effective learning.
• The system exhibited high-quality deception and transparency.

Conclusions:

• The proposed framework successfully integrates explainability, adaptability, and advanced AI techniques for effective cyber deception.
• The system enhances passive honeypots, transforming them into intelligent, autonomous threat detection systems.
• This research advances the state-of-the-art in cyber deception by providing a transparent and adaptive solution against evolving cyber threats.