AI-Driven Cyber Deception: A Reinforcement Learning Honeypot Framework with Threat Intelligence and Automated Containment
Year: 2026
Type: preprint
Abstract: Honeypots are widely used cyber-deception tools for diverting adversaries and collecting behavioral telemetry, yet most deployments remain static and increasingly easy to fingerprint, limiting engagement and reducing the quality of collected intelligence. A dynamic AI-powered honeypot framework is proposed that integrates three capabilities into a single closed-loop defense pipeline: (i) a reinforcement-learning (RL) deception agent, formalized as a Markov Decision Process (MDP) and trained via tabular Q-learning, that continuously adapts the honeypot's exposed persona and interaction tactics; (ii) real-time threat-intelligence fusion using Indicators of Compromise (IoCs) to contextualize and guide deception decisions; and (iii) automated containment actions that reduce time-to-response after detection. The framework is evaluated in a virtualized, isolated testbed across five representative adversarial behaviors: SSH brute-force, port scanning, command injection, SQL injection, and a multi-stage intrusion culminating in a Meterpreter session. Across 193 labeled sessions, the framework achieves 97\% detection accuracy with a 3.8\% false-positive rate, extending the mean attacker dwell time by 4.4× compared to a static baseline while containing threats within a mean of 1.9 seconds. A Deception Index (DI) is formalized to quantify adaptive deception efficiency, and Mean Time to Containment (MTTC) is introduced as a standardized response metric. The modular architecture is validated on an enterprise-grade VMware stack and is designed for broad deployment across cloud, enterprise, and IoT environments, offering a replicable template for integrating adaptive deception into operational security workflows.
Source: Research Square
Authors: Iqra Hussain, Monther Aldwairi, Azka Wani
Institution: Zayed University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7155827872