Explainability-driven adaptive cyber deception control system for autonomous network defense

Abstract

The increasing sophistication of cyber threats has led to the identification of some major shortcomings associated with honeypots, which include staticness, inflexibility, and vulnerability to fingerprinting. The proposed work aims at overcoming the aforementioned shortcomings by creating an Explainability-Driven Adaptive Cyber Deception Control System capable of engaging in intelligent, interactive interactions with cyber attackers. The key goal of the proposed solution is to improve threat intelligence gathering and deception efficiency by leveraging the benefits of adaptability and explainability. Machine learning, XAI, behavioral profiling, and environment mutation are the four key components that form the backbone of the proposed pipeline system. A Random Forest classifier is used for classification of normal and malicious sessions based on behavioral features at the level of commands. An explainability-driven metric known as the Feature Dominance Deception Index (FDDI) is developed to guide deception approaches, whereas Behavioral Convergence Score (BCS) is considered to assess behavioral convergence of attackers. Intent recognition using kill chain methodology allows generating responses in context-dependent fashion, while the mutation engine creates unique environments in each session to prevent fingerprinting attacks. Furthermore, Reinforcement Learning (RL) layer based on Q-learning is added to the framework to adaptively make decisions by learning the best possible deception tactics over multiple sessions. The Deception Quality Score (DQS) metric is used to measure the quality of deception within each session. Moreover, the UNSW-NB15 network intrusion data set is employed for validating the proposed model. Through benchmarking based on the generated behavioral dataset, the Random Forest-based behavioral profiler yielded a classification accuracy of 90.0%, recall of 85.7%, and an F1-score of 92.3%. Thereafter, the end-to-end deployment of the proposed framework through Cowrie honeypot sessions yielded better deception effectiveness, giving a framework-level attack classification accuracy of 90.0% and a 77.0% improvement in threat intelligence extraction per session than baseline Cowrie deployment. Kill chain stages were identified for the evaluated cases, deception goals were accomplished for all sessions under testing, fingerprinting efforts by the attacker were unsuccessful, and high-quality deception was maintained. The reward per session for the RL agent ranges from + 0 to + 14.0 for different session types, resulting in the formation of a converged Q-table containing values of 21 out of 90 possible states. Additionally, the technique ensures the resistance against honeypot fingerprinting, and demonstrates resistance against evaluated fingerprinting attempts. As far as it is currently known, few previous works can be found which have managed to include explainable scoring, convergence of behavior analysis, adaptive control, environment mutation, and reinforcement learning into one cyber deception framework. The presented framework manages to incorporate all of these features while still preserving transparency and adaptability during the whole process of deception. The research makes advances in the current state-of-the-art research by enabling passive honeypots to become intelligent autonomous systems for detecting cyber threats.

Introduction

The rapid advancements of cyber technology have resulted in increased sophistication and number of cyber attacks. The modern day cyber attackers use automated approaches and adaptive multi-steps attacks in their efforts to penetrate into a computer system. Hence, the conventional cyber security systems like firewalls and intrusion detection systems, which mainly concentrate on preventing and detecting any attacks by attackers, may not be enough against the new sophisticated attacks. Traditional cyber security approaches usually lack features that can understand the intentions and behavior of the attackers and manipulate their actions.

The concept of cyber deception includes methods of actively engaging with an attacker during a cyber attack. One of the most common forms of cyber deception is a honeypot. It mimics an operating environment and acts as bait for the cyber attackers. In this regard, Cowrie is an open source SSH honeypot that simulates Linux and logs the attacker’s activities in the server. However, there are some limitations associated with the traditional honeypots. For instance, they have a static configuration, are not intelligent in their response to attacks, do not possess any way of knowing the behavior of the attackers and can be fingerprinted. Thus, it becomes possible for highly-skilled hackers to easily detect such systems and interrupt the interaction process, making deception less effective and weakening the quality of gathered information.

Modern breakthroughs in the field of machine learning and explainable artificial intelligence bring hope for solving this problem. The efficiency of intrusion detection using machine learning algorithms was proved in various researches that were focused on identifying patterns in big data sets. At the same time, there is one important disadvantage of current technologies—most machine learning techniques concentrate on network-level characteristics while ignoring command-level features that are applicable for honeypot attacks. Moreover, black-box models often have serious problems with being explainable, while explainable AI helps to overcome this obstacle.

However, despite the mentioned advantages of modern technologies, there is still a number of issues in the field of machine learning application in cybersecurity and intruder detection. In particular, there are significant gaps related to the development of adaptive cyber deception system that integrates explainable decision-making techniques. It means that current technologies ignore explainable decision-making methods and cannot provide a temporal behavioral profile of potential hacker based on contextual models such as cyber kill-chain. These shortcomings emphasize the necessity of having a cohesive approach that considers behavior analysis, explainability, and adaptive response generation.

Drawing motivation from these issues, this work puts forth an Explainability-Driven Adaptive Cyber Deception Control System, which enhances a classic honeypot to make it more intelligent and interactive in its operation. Machine learning, explainable score, behavior analysis, and dynamic environment mutation are incorporated into this system. As the basis for classifying behaviors as either malicious or benign, the authors use a Random Forest classifier. Feature Dominance Deception Index is a new concept used in this study for determining risk using explainability to formulate deception plans. Another measure included in this research is the Behavioral Convergence Score, which allows for assessing consistency over time. Moreover, a kill-chain-based intent detection tool and a mutation engine for creating different environments for every session are incorporated into the proposed system.

The motivation behind this work is the need to address the shortcomings of conventional honeypots such as non-adaptability, lack of understanding of the intention behind the attack, and susceptibility to fingerprinting. The ever-evolving nature of cybersecurity threats makes it necessary to create smart systems that are able to analyze and react in real time. The primary objectives of this study include designing an adaptable cyber deception system that uses machine learning techniques to classify attackers, employ explainable artificial intelligence to enable transparent decisions, identify the intentions of attackers through the use of the kill-chain approach, and respond deceptively without being detectable by a honeypot.

The main contributions made by this paper are discussed below. From the present state of knowledge, it appears that relatively few researches have ever been able to combine all five concepts (explanation-based scoring, behavioral convergence, adaptive control, session-consistent mutation, and reinforcement learning) in one cyber deception paradigm. The suggested paradigm solves this problem through their combination along with retaining all transparency and adaptiveness. A new behavioral parameter is defined which considers the consistency of the attacks across multiple sessions. In addition, hysteresis-based control is introduced which provides robustness against instabilities in the system response. The concept of session-consistent environment mutation is also implemented which helps evade detection while graph storage is used for intelligence analysis from multiple sessions. Moreover, the sensitivity analysis on the parameters related to the controller and reinforcements is discussed for the robustness of the designed control architecture. In addition to these fundamental developments, this work further enhances the framework by including a Reinforcement Learning (RL) intelligent layer for adaptation purposes. Contrary to the traditional deterministic hybrid profiler that assigns constant weights to risk indicators, the RL model is able to adapt the policy for deception policy selection according to the accumulated reward signals through the interaction of the attacker during each session. It is worth noting that this paper aims to overcome an important drawback of previous systems; namely, their inability to adapt their deception policies due to lack of learning capabilities.

Literature review

There is a clear pattern in the academic discourse on cyber deception, with the field moving away from descriptive frameworks and towards more complex, adaptive, and AI-based cyber deception architectures. The first wave of seminal research was primarily focused on describing cyber deception and creating relevant models and concepts. For instance, Javadpour et al.¹ offer a taxonomy of different cyber deception methods, including the introduction of fake data and fabrication of processes. On the other hand, this article describes different methods without proposing an adaptive cyber deception strategy. Similarly, Pawlick et al.² describe attacker-defender interactions in the context of games and create corresponding game-theoretical models but base their analysis on assumptions regarding the behavior of actors, which are far too static to reflect the complexities of real-life scenarios. Another notable example is the work of Shinde et al.³, where the authors propose i-POMDP for inferring attacker intent. This approach offers a sophisticated mathematical model that can inform cyber defenders but is computationally intensive and lacks empirical support. Table 1 provides a comparative analysis of foundational and theoretical models of cyber deception, specifying their strengths and weaknesses from the methodology perspective.

Table 1.

Foundational and theoretical models.

Paper title	Main focus	Methodology	Key contributions	Limitations
Javadpour et al.1	Cyber deception taxonomy	Survey-based classification of deception techniques including false data injection, decoy systems, and fabricated processes	Provides structured taxonomy of cyber deception	Descriptive only, no adaptive mechanisms, evaluation framework, or real-time applicability
Pawlick et al.2	Strategic deception planning	Game-theoretic modelling (Stackelberg games) simulating attacker–defender interactions under strategic assumptions	Formal mathematical framework for deception strategies	Assumes static rational attackers, lacks dynamic adaptability and real-world applicability
Shinde et al.3	Attacker intent inference	i-POMDP modelling to handle uncertainty and infer hidden attacker intent	Enables probabilistic reasoning under uncertainty	High computational complexity, lacks scalability and empirical validation
Huang and Zhu21	Adaptive defense paradigm	Bayesian learning combined with reinforcement learning for dynamic strategy updates	Introduces “3A” (Active, Adaptive, Autonomous) framework	Difficult to quantify real-world parameters, challenging implementation

In the recent years, there has been a trend towards adaptive AI-based cyber deception solutions, which allows to achieve greater interaction realism but raises issues associated with explainability and continuity of responses. Ebunoluwa and James⁴ developed machine learning-based adaptive honeypots capable of dynamically adjusting their responses depending on attackers’ actions, however, these adaptive systems remain non-transparent and non-descriptive in terms of linking intents to corresponding actions. Similarly, the work by Wushishi et al.⁵ suggests applying reinforcement learning for protecting Industrial IoT networks, making it possible to create adaptive defense systems, however, the use of this approach limits the possibility to explain and understand the system’s behavior. Moreover, Sladić et al.⁶ created highly realistic and fully-interactive AI-powered cyber deception systems but offered limited explanations of their adaptive response capabilities. Finally, Samhruth et al.⁷ proposed an efficient system combining honeypots, probabilistic encryption, and machine learning models, thus offering evidence for the effectiveness of multicomponent systems in cyber deception, but again ignoring attacker intent-response relationships. Table 2 describes AI-driven adaptive deception systems and analyzes the advantages and difficulties associated with their real-time interaction capacity.

Table 2.

AI-driven adaptive deception systems.

Paper title	Main focus	Methodology	Key contributions	Limitations
Ebunoluwa and James4	Adaptive honeypots	Machine learning models trained on attacker interaction data to dynamically generate responses	Improves realism and engagement	Black-box decisions, no explainability or intent-response mapping
Wushishi et al.5	IIoT defense	Deep Reinforcement Learning for context-aware adaptive decision-making	Real-time adaptive protection in IIoT	Opaque decision-making, difficult interpretability
Sladić et al.6	Interactive deception	AI simulation of real environments for attacker engagement	High realism	Lack of transparency in adaptation logic
Samhruth et al.7	Integrated adaptive security	Combination of honeypots, probabilistic encryption, and ML-based adaptation	Multi-layer adaptive defense system	No session-level tracking, weak behavioral continuity

Parallel studies on XAI have sought to tackle the issues associated with black-box algorithms, especially in IDSs. For instance, Rjoub et al.⁸ have offered a taxonomy of XAI approaches and metrics of evaluation, such as stability and robustness, to enhance interpretability frameworks, yet the methods remain impractical in real-time settings. On the other hand, Udofot et al.⁹ have applied SHAP and LIME for explaining neural network-based intrusion detection models, increasing the confidence of analysts in the output, yet imposing significant computational costs in high-traffic networks. In addition, M. Khan et al.¹⁰ have created an ensemble IDS with global and local explanations, which ensures high accuracy in detection and low response time, yet raises issues around the balance between the thoroughness of explanations and system throughput. Similarly, Arreche et al.¹¹ have introduced XAI-IDS, which uses various models to increase robustness through overlapping feature importance, yet relies on post-hoc explanation, which fails to capture internal causalities. In another study, Xu et al.¹² have presented EI-XIDS, which combines different explanation frameworks to increase fidelity but complicates system architecture.

Likewise, Akande et al.¹³ developed a metadata-based intrusion detection model for encrypted traffic, which demonstrated efficacy but was susceptible to evasions due to traffic shaping attacks. While both these methods provide effective results, both of them exhibit the inherent trade-off between interpretability and speed, thus proving ineffective against high-speed threats. In addition, behavioral modeling and attack analysis methods have also been studied, although only in their basic forms. For instance, Pateria et al.¹⁴ used clustering to classify attacker behavior based on interaction logs, thereby allowing attackers to be traced across multiple systems, although their model needed sufficient data and, hence, was not applicable to quick attacks. Moreover Ahmed et al. (2023)¹⁵ suggested the SODA method, which identified malicious subgraphs of malware API call sequences and mapped them to MITRE ATT&CK framework, providing a possible way to use graph modeling for cyber deception. However, this process could not dynamically evolve, thus making it useless for an effective adaptive cyber defense. Finally, Islam et al.¹⁶ proposed the CHIMERA model, which relied on POMDP adaptive deception to deploy honey files dynamically. However, the process proved to be computationally intensive, reducing scalability.

Many researchers have studied adaptive deception techniques in the network domain. The authors Chiang et al.¹⁷ published ACyDS—a deceptive solution in 2016 built around SDN, enabling it to distort the topology in real-time. It has the capability to deceive or mislead attackers, however, it suffers from increased management costs and can disturb legal traffic.

Explainable intrusion detection has been analyzed by Larriva-Novo et al.¹⁸, where the authors have considered using explainability algorithms for detecting cyberattacks in real-time via employing Random Forest on the UNSW-NB15 dataset. As a result, the researchers identified critical network flows’ features such as time-to-live and byte counts, emphasizing the possibility of enhancing the detection process and selecting the most promising features through their direct analysis. It is consistent with the trend towards creating explainable and interpretable intrusion detection systems. However, it should be acknowledged that this research suffers from an important flaw: it is based only on one particular dataset, hence limiting its generalizability to different network environments with varying topologies and characteristics. In Table 3, the use of interpretability techniques in XAI-based IDS is analyzed regarding performance.

Table 3.

Explainable AI in intrusion detection systems.

Paper title	Main focus	Methodology	Key contributions	Limitations
Rjoub et al.8	XAI taxonomy	Classification of XAI techniques based on evaluation metrics like robustness and stability	Structured XAI framework	No real-time implementation
Udofot et al.9	Explainable IDS	SHAP and LIME applied to neural network IDS	Improves interpretability	High computational overhead
Hassan and Khan10	Ensemble XAI IDS	Ensemble models with local and global explanations	High accuracy with interpretability	Trade-off between explanation depth and performance
Arreche et al.11	Multi-model XAI	Multiple models with overlapping feature importance comparison	Improved robustness	Post-hoc explanations, lacks causality
Xu et al.12	EI-XIDS	Integration of multiple XAI frameworks with fidelity evaluation	Improved explanation fidelity	Increased system complexity
Akande et al.13	Encrypted IDS	ML on traffic metadata with XAI explanations	Works on encrypted traffic	Vulnerable to evasion
Larriva-Novo et al.18	XAI IDS	Random Forest on UNSW-NB15 with feature importance analysis	Identifies key network features	Limited generalizability due to single dataset

In 2024, Kouremetis et al.¹⁹ designed Mirage, integrating automatic planning and reinforcement learning methods for misleading autonomous attackers. While it slows down attacks efficiently, its impact on human opponents is limited.

In 2021, Landsborough et al.²⁰ conducted a comparative study, comparing static and adaptive deceptive techniques, showing that there are significant benefits from using adaptive approaches. However, this research did not completely address the complexity of interactions.

In 2020, Huang and Zhu²¹ suggested a threefold structure based on strategic learning called 3 A (active, adaptive, autonomous), offering theoretical guidance, although implementation can be complicated due to difficulty in assessing the cost-benefit trade-off of any system. Table 4 compares behavioral modeling and adaptive approaches to deception with regard to tracking of attackers and scalability.

Table 4.

Behavioral modelling and adaptive systems.

Paper title	Main focus	Methodology	Key contributions	Limitations
Pateria et al.14	Behavior clustering	K-means clustering on attacker logs	Tracks behavior across interactions	Requires long-term data
Ahmed et al.15	Graph-based malware analysis	API call subgraphs mapped to MITRE ATT&CK	Introduces graph-based modelling	No real-time graph evolution
Islam et al.16	CHIMERA system	POMDP-based adaptive deception	Dynamic deception deployment	High computational cost
Chiang et al.17	SDN deception	Dynamic topology changes using SDN	Prevents reconnaissance	High overhead, disrupts traffic
Kouremetis et al.19	Autonomous deception	RL with automated planning	Effective vs. automated attackers	Weak vs. human attackers
Landsborough et al.20	Dynamic decoys	Game-theoretic evaluation of decoys	Shows adaptive decoy benefits	Simplified assumptions
Huang and Zhu21	Adaptive defense	Bayesian + RL learning	Conceptual adaptive model	Hard real-world deployment

Recently, studies have been conducted to understand the impacts of generative AI and adversarial attacks on cybersecurity. The study by Baniecki and Biecek²² focused on the vulnerabilities of adversarial attacks on explainable artificial intelligence models, revealing flaws in data poisoning techniques that can result in erroneous explanation. The research by Senevirathna et al.²³ identified another form of attack, known as scaffolding, which involves using seemingly harmless explanations for justifying harmful predictions. These attacks can be detected using statistical divergence methods. In another study, Niculae et al.²⁴ developed an approach to deal with adversarial attacks by proposing a framework to integrate explainable artificial intelligence with deception tactics to combat these cyber threats. In Table 5, advances in adversarial AI and cybersecurity threats are provided emphasizing vulnerabilities in explaining and defending against them.

Table 5.

Adversarial AI and emerging threats.

Paper title	Main focus	Methodology	Key contributions	Limitations
Baniecki and Biecek22	XAI attacks	Study of adversarial attacks like data poisoning	Identifies XAI vulnerabilities	Limited mitigation strategies
Senevirathna et al.23	Scaffolding attacks	Statistical divergence detection methods	Detects misleading explanations	Difficult deployment
Niculae et al.24	XAI + deception	Hybrid framework combining XAI and deception	Bridges defense strategies	Limited robustness

The work of Mallidi et al.²⁵ is a highly regarded and comprehensive review article that investigates nature inspired optimization methods to improve deep learning based methods utilized for cybersecurity systems. A systematic examination of the use of various algorithms such as Genetic Algorithms (GA), Particle Swarm Optimization (PSO), Ant Colony Optimization (ACO), and Whale Optimization Algorithm (WOA) for the purposes of feature selection and hyperparameter optimization, has been presented in this article for the areas of intrusion detection, malware analysis, and anomaly detection. The work is important because it takes a variety of different optimization methodologies and places them into one overall framework while emphasizing their ability to enhance accuracy of detection, lower computational complexity, and provide better adaptability to changing adversarial environments. The article provides a foundation for future research in intelligent and adaptive cyber defense systems through demonstrating the effectiveness of metaheuristic optimization in improving machine learning based cyber defense solutions. Additionally, while the work focuses primarily on optimization and classification performance, it identifies many potential areas for additional future research relating to explainable deception in cyber environments, behavioral analysis of attackers, and autonomous system based on deception that provide defense mechanisms.

The framework proposed by Mallidi et al.²⁶, which utilizes machine learning has been established to classify both VPN and non-VPN encrypted traffic. The proposed method consists of three parts: feature extraction from CICFlowMeter; feature selection with Bowerbird-Based Feature Selection (BBFS); and classifier tuning using Particle Swarm Optimization (PSO). The study represents a significant step forward in the area of cybersecurity by showing that biodiversity derived optimization techniques can achieve enhanced classification accuracy, an increase in the efficiency of the model, and provide an increase in the ability to interpret the model. By providing extensive evaluations across several benchmark datasets, the authors have established that the proposed framework will yield very good predictive accuracy and significantly reduce modelling complexity and feature dimensionality, thereby providing a means of actually using their proposed solution in security networks. The authors of this study deserve particular recognition for emphasizing the use of interpretable tree-based models in their study, rather than relying only on “black box” methods, thus contributing to the increasing demand for transparent Artificial Intelligence in cybersecurity. Despite this significant effort to provide a means by which to classify and identify malicious network traffic, the proposed framework does not provide a means by which to be used in the development of adaptive cyber deception and/or inference of an attacker’s intent, behavioral profiling, and/or strategies for developing autonomous defenses based on interpretation. These represent major areas for future work. In Table 6, the use of Nature-Inspired Optimization in Cybersecurity Systems is analyzed.

Table 6.

Nature-inspired optimization in cybersecurity systems.

Paper title	Main focus	Methodology	Key contributions	Limitations
Mallidi et al.25	Deep learning optimization for cybersecurity	Nature-inspired algorithms (GA, PSO, ACO, WOA)	Improves ML performance and adaptability	No deception or explainability integration
Mallidi and Penmatsa26	Encrypted traffic classification	BBFS + PSO with tree-based models	High accuracy and interpretability	No adaptive deception or intent analysis

In the existing literature, there is a clear trend toward intelligence, adaptivity, and explainability within cybersecurity frameworks. However, a number of deficiencies can still be seen. First of all, there is no unified approach incorporating adaptive deception, explainability, and behavioral modeling at once. Many cybersecurity solutions lack the ability to provide session-level integrity and monitor attackers during the entire attack process. Modern machine learning techniques, such as transformer-based sequential models and anomaly detection based on graphs, are not applied efficiently enough. Also, the problem of ensuring real-time performance in the context of explainability is still not solved.

Methodology

Overall methodological framework

The proposed methodology for cyber deception takes a layered approach whereby attacker interactions are gradually translated into deception actions through behavioral modeling, explainable scoring, adaptive control, and performance evaluation. In lieu of describing the technicalities involved in implementing the framework, this section introduces the analytical approaches and control strategies employed by the framework, and “System architecture” and “Implementation” cover architecture and implementation aspects of the proposed framework.

From a purely theoretical point of view, there are five main phases involved in the proposed methodology. The first phase entails collecting the interaction data of attackers from the honeypot and preprocessing them into command-level observations. Second, the observations are further represented behaviorally and classified using machine learning algorithms to differentiate between benign and malicious behavior. Third, through explainability-driven scoring and behavioral convergence analysis, deception control information is extracted from the attacker behavior observation process. Fourth, the information is used to make adaptive decisions in terms of deception using hybrid control consisting of hysteresis and reinforcement learning-based policies. Apart from the deterministic control approach, the proposed approach also utilizes an adaptive reinforcement layer that uses Q-learning for enhancing the system. The reinforcement learning component acts as a mechanism through which the system learns through rewards which are the most effective deception strategies for maximizing the attack engagement and intelligence gathering during the session. The method differs from static deception policies in that it improves through experience without sacrificing explainability-based control. This design allows for the system to operate within a closed-loop deception system where an attack behavior affects the internal state of the system, influencing future actions selected by the system. This approach supports both adaptive deception and learning within the methodology.

Threat model assumptions

The threat modeling framework makes certain assumptions about interactions among attackers, assuming such interactions occur through the use of SSH access made available by the honeypot. Furthermore, any attacks against the host where the deception system is running will not be considered part of the threat scenario; nor will interactions with commands and control mechanisms that do not make use of the interactive deception environment. The model also considers that adversaries do not have access to a privileged escape from the honeypot system host.

Data acquisition and preprocessing

The first phase of the methodology is the acquisition of data through real attacker interactions with the Cowrie SSH honeypot system. The honeypot logs every single command provided by an attacker in JSON format, where important details such as the command’s content, session ID, timestamp, and IP address are logged. This results in a dataset which represents the realistic activities of attackers in an artificial setting.

Since the goal is to analyze these commands through a processing pipeline, the acquired raw data must be preprocessed into a suitable format for further analysis. This step entails the cleaning and parsing of each command to remove any noise or unimportant details while retaining the command’s semantic meaning. The emphasis of this step is to prepare meaningful command tokens for analysis.

Alongside the real-world logs, another artificial data set is created to train the machine learning algorithm. In terms of its structure, the dataset is determined based on the distribution of classes and their behavior according to KDD Cup 1999, the well-known intrusion detection dataset. Although this dataset describes attacks at the network level, it cannot be used as a training tool at the command level, and consequently, its usage in this study is limited to the description of ratios between attack and non-attack behaviors. Specifically, the artificial dataset contains 5,000 data points belonging to several behavioral groups, which include normal behavior of a legitimate user, attacks based on reconnaissance actions, harvesting credentials, fingerprinting the system, and finally high volume attacks. Even though KDD Cup 1999 does not wholly reflect the current attack distributions, it was not employed as a benchmark data set in this research. It is employed only in order to guide the distribution of behaviors when creating synthetic data sets. Data sets such as UNSW-NB15 and CIC-IDS2017 have been employed in this regard. Each of the data points is described using four variables that correspond to behavioral classes identified earlier. Figure 1 illustrates the distribution classes within the dataset used for training. In order to avoid any confusion about the methodology of evaluation, the purpose of each dataset used in the current research is clearly defined. In particular, the artificially created behavioral dataset, which comprises 5000 samples, is used only for training the Random Forest classifier in the introduced command-level behavioral feature space. The real attacks captured via the Cowrie SSH honeypot were used for the end-to-end testing of the proposed deception framework in operation. The UNSW-NB15 and CIC-IDS2017 datasets were included in order to evaluate the reusability and retraining capabilities of the proposed solution using the recent intrusion benchmarks. Finally, the KDD Cup 1999 dataset statistics was used only for generating the approximate proportion of behavioral categories when constructing the synthetic dataset.

Fig. 1.

Class proportion of the 5000-sample dataset used to train Random Forest Classifier.

The purpose of using each of the datasets in the suggested research is described below: (i) 5000 sample synthetic dataset for training the Random Forest algorithm, (ii) Cowrie logs for evaluating end-to-end implementation, (iii) UNSW-NB15 and CIC-IDS2017 datasets for the purposes of retraining and assessing transferability, and (iv) KDD Cup 1999 dataset for defining approximate behavior ratios for synthetic dataset creation.

Feature engineering and behavioral representation

Feature engineering serves as an important part of structuring the input command sequence into meaningful representations. Each command is categorized into one of four behavioral classes: reconnaissance, file operations, system information, and others. Behavioral classes are determined based on the observed activities of attackers on honeypots and are chosen to provide concise but meaningful descriptions of behaviors. Instead of using features extracted from each command separately, feature counts of all commands within a session are accumulated to build a behavioral profile. In this way, the system can observe the development and changes in the pattern of behaviors and differentiate benign actions from malicious ones accordingly. The feature vector of commands is thus formed based on the counts of each behavioral class, which results in a four-dimensional vector.

To achieve higher interpretability, the contribution value of each feature is calculated by dividing the corresponding feature count by the total number of commands in the session. Thus, we can get a more understandable representation of behavioral dominance, i.e., whether one kind of activity dominates others within the session. Contribution values are used as the basis for explanation-based decision-making in further procedures.

Machine learning model and training strategy

The classifier of the proposed system is based on the Random Forest approach owing to its effectiveness, robustness, and interpretability. The classifier is trained on the generated data that emulates realistic patterns of the attacker’s behavior within the feature space. In contrast to classical approaches based on the analysis of network-based features, the described approach uses the characteristics of the commands used by the attacker. A set of decision trees used in Random Forest performs classification through the aggregation of predictions during the inference procedure. Specifically, for each new input, the model produces a binary prediction indicating whether the analyzed session is malicious or not. Besides the final prediction, the algorithm returns a certain score corresponding to the prediction uncertainty and required to integrate prediction results and explainability scores.

The selection of the Random Forest model is based on the effective operation in the low-dimensional feature space and the combination of accurate prediction and good interpretability. Furthermore, high computational speed enables real-time classification. In order to assess the performance of classifiers not only on the basis of accuracy, but also through other supervised learning metrics, precision, recall, and F1-score were further considered. Precision is an indicator of the percentage of predictions made by the model that are actually malicious attacks, while recall is an indicator of the percentage of the real malicious attacks detected by the algorithm. The F1 score is a measure of precision and recall, serving as their harmonic mean and accounting for the issue of class imbalance. Moreover, in order to study the performance of the model on discrimination, ROC curve and area under curve (AUC) analysis was conducted, alongside confusion matrix analysis.

Explainability-driven scoring mechanism

To add clarity to the process and improve decision-making, the system adopts a metrics approach, which is explainability-driven and referred to as the Feature Dominance Deception Index. The Feature Dominance Deception Index is a metric whose components include feature contributions, predetermined behavior weights, and confidence.

The Feature Dominance Deception Index is mathematically defined as Eq. (1):

1

Here, FeatureContribution_i stands for the normalized value of contribution of each behavior category in a session, while BehaviorWeight_i stands for the specified value of weight for every behavior type. PredictionConfidence represents the confidence level produced by the machine learning algorithm, and it serves as the multiplicative scaling factor on the behavioral sum. The above formula makes sure that the FDDI is proportional to the confidence level of the model: the higher the confidence level is, the larger impact of the behavioral data will be seen in the final deception index; conversely, if the confidence level is low, which happens, for example, during the initial commands of a session and before enough behavioral information can be accumulated, the FDDI is artificially lowered, because we don’t want the system to escalate deception too fast. In addition, the confidence levels are growing with the number of commands observed in a session, which results in natural increase of FDDI and progressive strategy escalation.

This formulation ensures that both behavioral dominance and confidence of predictions considered by the product of the two. For the FDDI to be high, there should be a combination of both risky behaviors and confidence in model predictions at the same time. Low-risk behavior sessions or low confidence of prediction results will generate low FDDI, hence, the system will stay in passive or medium deception until there is enough evidence of threats. This was done purposely so that the system will not deploy any deception until there is clear evidence of threats.

Explainability-driven scoring helps in making the system able to determine which behavioral patterns have dominance in the decision-making process and also why the system picks a certain strategy of deception. Table 7 provides an illustration of the deception strategies employed using FDDI ranges. The full pipeline and strategy mapping used is outlined in Fig. 2 below.

Fig. 2.

FDDI computing processes that convert SSH commands to normalized deception control signal and the deception strategy level.

Table 7.

FDDI-based deception strategy levels.

FDDI range	Strategy level	Description
0.0–0.3	Passive monitoring	Minimal intervention; standard Cowrie responses
0.3–0.6	Medium deception	Plausible but subtly misleading environment
0.6–0.8	Full environment simulation	Richly fabricated system with honeytokens
0.8–1.0	Containment sandbox	Maximum deception with Docker decoy network

Behavioral profiling using convergence analysis

The method utilizes the behavioral profiling module to study the coherence of the attacker’s actions. This is done by calculating the Behavioral Convergence Score that shows the deviation between subsequent explainability scores.

The Behavioral Convergence Score is computed as Eq. (2):

2

In this equation, the mean absolute difference between two consecutive FDDI measures serves as a representation of the behavioral dominance variance through time. The subtraction of this figure from one normalizes the score, indicating the degree of behavioral consistency, whereby a higher score corresponds to greater consistency and a lower score to less consistency.

An elevated BCS figure implies that the attacker behaves in an orderly fashion and follows a specific pattern of behaviors, a typical indication of a focused, well-thought-out approach to attacking. On the other hand, a BCS score closer to zero implies that the attacker’s behavior is random, disorganized, and inconsistent with previous actions. Thus, the system can determine whether an adversary is acting systematically by employing automated scripts to probe or launch an attack against its infrastructure.

BCS’s incorporation in the system’s decision-making process improves its capability to detect various forms of attacks and adjust its deceptive technique accordingly, depending on whether the adversary’s behavior is random or systematic. Whereas typical methods of behavioral profiling rely mainly on either frequency or clustering techniques to describe attackers’ behavior, the suggested Behavioral Convergence Score measures the temporal coherence of attacker behavior using the explainability trajectory based on FDDI values sequentially obtained. The proposed framework will be able to differentiate between systematic and opportunistic attacker behavior in a transparent way.

Hysteresis-based decision control

The selection of appropriate adaptive response strategies in the system model can be achieved through a combination of deterministic hysteresis control together with policy adaptation via reinforcement learning approach. Specifically, the hysteresis controller acts to stabilize the transition between different deception tactics by avoiding any oscillations that might occur due to transitory risk changes, while on the other hand the reinforcement learning mechanism helps adaptively optimize the selection of appropriate deception actions.

In essence, such an approach would ensure both stability and adaptability of the deception strategy decisions in a way where the former occurs on the basis of thresholds and the latter through rewards. In order to achieve stability in the decision process, a hysteresis-based control technique is used. The use of such a technique allows the implementation of two boundaries for switching between states related to a particular level of strategy usage.

Based on the value of the explainability score and behavioral convergence score, the control algorithm can decide whether it is necessary to increase or decrease the level of response strategy usage. In addition, an element of feedback delay is applied, which makes it impossible to switch states faster than the minimum period determined by the system. This technique is vital for ensuring realistic system behavior, as any sharp changes in the system behavior can indicate its artificiality to hackers. The hysteresis controller state transition process is outlined in Fig. 3 below.

Fig. 3.

State transitions of the hysteresis control system which show risk levels, threshold, cooldowns and escalation bias.

Hysteresis thresholds (0.45, 0.55, and 0.75) are different from nominal FDDI approach range. This is because hysteresis thresholds are utilized exclusively for transition between levels of risks in the feedback controller and provide an increase/decrease buffer to minimize oscillations and deception stabilization.

Intent detection and kill-chain mapping

After decision-making for control actions is completed, interpretation of the attacker’s intent is made using kill-chain phase correlation to facilitate the creation of an appropriate deception response that takes into account contextual awareness. Rather than considering each individual command in isolation, this approach assesses command strings as behavioral cues for understanding the attacker’s intentions.

With this in mind, as well as based on the attacker’s intentions and the level of deception currently being implemented, a suitable response can then be formulated that does not compromise environment variance. The proposed method involves the use of an intent detection module that utilizes the kill-chain concept as a framework for gaining insights into the actions taken by attackers. The system performs analysis on strings of commands, categorizing them under one of five phases, namely, reconnaissance, exploitation, persistence, lateral movement, or exfiltration.

Each command contributes towards a phase score, and the phase with the maximum accumulated score above a certain predetermined threshold is chosen as the attacker intent. Through this process, the system achieves a deeper level of comprehension of the actions taken by the attacker, thus improving its response to the attack. The mapping of attacker actions to different kill chain stages is outlined in Fig. 4.

Fig. 4.

Kill-chain intent detection at five stages of the attack cycle and the corresponding deception responses.

Adaptive response generation and environment mutation

During the response generation stage, the output generated by the control system and the intent detection engine are combined to generate dynamic and believable deceitful responses. The mutation engine alters the attributes of the system, such as the hostname, filesystem layout, processes, and network configurations, to form an environment that is different for every connection.

The mutation technique is deterministic within a single session and stochastic between sessions to avoid fingerprinting. This makes sure that the intruder will not detect patterns in order to determine whether or not they are interacting with a honeypot. The deception engine then creates responses that match the attack stage determined by the intent detection engine.

At present, the main type of communication the framework is designed for is SSH-based interaction observed through the Cowrie honeypot. Although such an approach allows for conducting a detailed command-level behavioral analysis, today’s corporate IT environments usually imply attacks that use multiple protocols. It is important to extend the proposed framework with respect to HTTP, HTTPS, FTP, and SMB protocols in the future.

Intelligence persistence and evaluation methodology

Firstly, the persistence methodology is geared toward supporting attacker pattern recurrence tracking, behavioral similarity across sessions, and relationships between indicators of compromise, attacker deceptions, and attacker behaviors. To represent such relationships, the methodology utilizes a graph-based intelligence paradigm that assumes that attacks, attack sessions, attacker behaviors, and their corresponding deceptions should be represented as graph entities rather than separate data records. The graph paradigm used is the main reason behind the use of Neo4j attack graphs in system implementation because they provide an opportunity to detect correlations, repeat attacks, and study attacks in several sessions. In comparison with table-oriented logging, graph-based persistence offers more structural information related to adversarial behavior representation.

Secondly, in addition to persistence of attacker intelligence, the methodology involves a multi-dimensional evaluation framework aimed at evaluation of detection and deceptions performance. Classifier oriented evaluation is carried out using conventional supervised learning evaluation techniques that include such measures as classification accuracy, precision, recall, F1 score, ROC analysis, and area under curve. In addition to classifier performance metrics, deception performance metrics have been defined to gauge how effective the deception framework has been at creating realistic engagements and successful deception. These include information collected per session, deception retention rate, resistance to fingerprinting attacks, and the Deception Quality Score (DQS). The DQS metric provides a measure of deception success qualitatively by evaluating the engagement duration, command interactions, stages of attack, and honeytoken interactions.

The two-tier approach of using a persistent intelligent model and deception performance metrics gives the framework the ability to analyze not just if the attacks were accurately identified, but if the deception framework was successful in engaging and deceiving attackers.

This framework consists of several interconnected modules, such as behavioral scoring for explainability, convergence analysis, adaptive control, reinforcement learning, intent mapping based on kill-chain approach, and environment mutation. For providing an improved methodology and making the work easily reproducible, the following algorithm, Algorithm 1, is given to describe the workflow of Explainability-Driven Adaptive Cyber Deception Framework.

Algorithm 1

Workflow for explainable adaptive deception.

Input: Stream of incoming SSH commands S.

Output: Adaptive deception response R.

Step	Description
1	Capture attacker commands from Cowrie honeypot logs.
2	Extract behavioral features and update the session feature vector.
3	Predict attacker behaviour using the Random Forest classifier.
4	Compute the Feature Dominance Deception Index (FDDI).
5	Update the Behavioral Convergence Score (BCS).
6	Apply hysteresis-based decision control.
7	Encode the reinforcement learning state representation.
8	Select a deception strategy using ε-greedy Q-learning.
9	Detect attacker intent through kill-chain mapping.
10	Generate a session-consistent mutated environment.
11	Deploy the deception response.
12	Persist intelligence within the Neo4j attack graph.
13	Update the Q-table using the observed reward.
14	Return the adaptive deception response (R).

Algorithm 1 describes the sequence of interactions between the major components of the designed framework while the next section focuses on the architecture and interconnection of those components.

System architecture

Overall system pipeline

This proposed architecture follows a processing pipeline design where each command issued by the attacker must pass through a series of stages until the intelligence generated at each stage is saved for use. The pipeline approach makes the architecture modular, since each stage takes a well-defined input and generates well-defined output while having one purpose only. This allows each module to be evaluated, replaced, and extended independently without affecting the other modules. The proposed pipeline has twelve stages, as shown in Fig. 5. Each stage is represented by one or more Python modules, and the whole pipeline runs on a single event loop monitoring the honeypot Cowrie log file continuously. As soon as the attacker issues a command, the JSON event generated from it is captured by the log tailed application, parsed, and passed through all stages of the pipeline.

Fig. 5.

Pipeline of twelve stages for the real-time functioning of the adaptive cyber attack deception engine.

The pipeline starts from command capture where the realtime_processor component tails the cowrie json log file and parses each event of command.input to obtain the raw command, session ID, source IP address, and time stamp of the event.

Module map and responsibilities

The system has 12 modules built in Python. Each module has its own unique responsibility that is not duplicated by any other module. A full module map can be found in Table 8. The modules are organized into four functional layers of detection, control, response, and intelligence.

Table 8.

Functional decomposition of the proposed framework and software modules corresponding to each architecture layer.

Layer	Module	Responsibility
Detection	feature_engine.py	Behavioral feature extraction, ML prediction, XAI contribution computation
Detection	profiler.py	Behavioral Convergence Score computation and pattern classification
Detection	intent_engine.py	Kill-chain stage detection and stage-specific deception response generation
Control	hysteresis_controller.py	Risk level transition management with Schmitt-trigger hysteresis bands and feedback delay
Control	rl/agent.py	Q-learning action selection and Q-table update
Control	rl/state_encoder.py	Pipeline signal discretization into 90-state index
Control	rl/reward_engine.py	Per-command and session-level reward computation
Response	mutation_engine.py	Session-consistent, cross-session-diverse fake environment generation
Response	network_deception.py	Real Docker decoy container deployment on threat detection
Response	rl/deception_quality.py	Deception Quality Score computation per session
Intelligence	memory_engine.py	Cross-session attacker behavioral history persistence
Intelligence	attack_graph.py	Neo4j graph storage for attacker, feature, session, and strategy nodes
Intelligence	session_similarity.py	Cross-session pairwise similarity scoring and campaign detection
Evaluation	ml_evaluator.py	Confusion matrix, ROC curve, precision, recall, F1, and error analysis
Evaluation	baseline_compare.py	Quantitative comparison against plain Cowrie baseline
Evaluation	benchmark.py	Aggregate metrics across all real attacker sessions
Infrastructure	nic_monitor.py	Hardware-level network traffic monitoring for exfiltration and port scan detection
Infrastructure	train_model.py	Random Forest classifier training on synthetic and NIDS datasets
Infrastructure	nids_integrator.py	UNSW-NB15 and CIC-IDS2017 dataset download, mapping, and model retraining

End to end data flow

In order to demonstrate how these modules all work within a live scenario, Fig. 6 will show the full data flow for the command “cat /etc/passwd”—a common representation of the exploitation phase of an attack.

Fig. 6.

End to end pipeline workflow for the command “cat /etc/passwd”.

The sequence of events in this command begins when the attacker enters the command “cat /etc/passwd” during an active SSH session to a Cowrie server. After the attacker enters the command, Cowrie captures the command, and saves it as an event in the cowrie.json file in a structured JSON format. The realtime_processor module detects this new line of data from the cowrie.json file using the tail of the file and parses the event and retrieves the session ID, source IP, and command string.

The command has been classified as a member of the file access category by the feature engine, which added to the count in the cumulative feature vector for the session. As an updating result, the feature vector is now represented as follows: even though all other categories are still assigned a count of 0, the file access category has been assigned a count of 1. At this point in time, the contribution normalizer divides each of the counts by the total count value, producing normalized fractions that represent the behavioral profile of the session up to this point. Calculation of a scalar value of the deception control signal according to the FDDI formula is performed through the multiplication of the prediction confidence with the weighted sum of contribution fractions and behavior weights. The result is high for behaviors with much evidence of deception, while being suppressed otherwise.

An entry of the latest FDDI score is appended to the session’s FDDI score history by the BCS profiler. Then, the BCS profiler will compute the mean absolute deviation value between the two most recent FDDI score data points, which provides a behavioral convergence value for determining how consistent or inconsistent an attacker would appear to be.

After the fifth command has been issued, the four-dimensional feature vector will be classified as being an attack and a binary prediction of 1 will be returned by the Random Forest model in support of this attack classification process.

Upon receiving the composite risk score from the hysteresis controller, it verifies whether that composite risk score exceeds a specified transition threshold level associated with a given strategy level. If the composite risk score exceeds the transition threshold level associated with the current strategy level, then it will also confirm whether or not the cooldown period has expired before determining whether to escalate to the next strategy level or maintain the same strategy level using composite risk scores. However, if the cooldown period has not expired for the respective risk score, then the hysteresis controller will maintain the same strategy level until the cooldown period for composite risk scores is complete. In parallel to reviewing and evaluating composite risk scores by the hysteresis controller, the RL agent encodes into a discrete state index the current, FDDI, BCS, the intent stage and the composite risk level. The RL agent will then select an action from the state index using its epsilon-greedy policy to update the Q-table by recording the state/action pair that corresponds to the current risk level.

The intent engine reviews the complete history of command execution against all five kill-chain stage profiles and identifies exploitation as the kill-chain stage which has the highest confidence of 0.65. The mutation engine creates a session consistent fake /etc/passwd file that contains plausible usernames and hashed passwords that are both unique to the current command session but also consistent across all of the commands initiated from within the command session. At the same instant, the network deception fabric identifies the exploitation signal and deploys legitimate Docker decoy containers, if decoy containers were not previously deployed for the current command session.

Upon closing a session the reward engine calculates a per-session reward from measures including engagement duration, command depth, and stage progression. The Q-table is updated with the reward signal; the memory engine appends the BCS of the session to the attacker’s cross-session history; the attack graph module writes the Attacker, Feature, Session, and Strategy nodes to Neo4j; and the session similarity engine computes pairwise session similarity scores for all sessions in the log.

RL state space and action space design

To encode the state of a system into an integer index that will allow for lookups in the Q-table, a reinforcement learning layer is created to map the current state of the behavior and context of the attacker into a discrete integer index used in Q-table lookup.

State space

State encoding requires four signal data inputs from the existing pipeline to create a discrete representation. The first signal input is the FDDI score. The FDDI score, which is a continuous score ranging between 0 and 1, is discretized into three possible levels (three being the maximum number of sampled levels) based upon the integer part of the produced FDDI score times three with a cap of two. The second signal input is the BCS score. The BCS score is also a continuous score that can range between 0 and 1; therefore, the BCS score is discretized to produce two possible levels that have a value greater than or equal to 0.5. The third component of the input signal is intent, which is translated into an integer index with values in the range 0–4. Intent stages include unknown, reconnaissance, exploitation, persistence, and lateral movement/exfiltration. In order to keep a compact state space, exfiltration is translated to the same state index as lateral movement. The fourth and final signal input is risk level. Risk level is mapped to an integer number from 0 to 2 to represent the levels of LOW_RISK, MEDIUM_RISK, or HIGH_RISK. This encoding of signals can be represented in the following formula: state = (FDDI_level × 30 + BCS_level × 15 + stage_index × 3 + risk_index). In total, there are 3 × 2 × 5 × 3 = 90 discrete states. The complete visualization of the encoding of these 90 states is illustrated in Fig. 7. Offline pre-training of the agent is carried out before deployment, but Q-values are refined during real-time deployment through online training.

Fig. 7.

RL state encoder diagram.

As the Hysteresis controller uses the risk levels of LOW_RISK, MEDIUM_RISK, and HIGH_RISK to classify attacker behaviors, the Reinforcement Learning Agent makes decisions using four levels of deception actions which are Passive Monitoring, Medium Deception, Full Environment Simulation, and Containment Sandbox. In contrast to the determination of risk levels which help classify attacker behaviors, reinforcement learning helps determine the optimal deception action for that risk level.

Action space

The agent can choose amongst four deceptive actions related to the four strategy levels outlined in the FDDI based deception strategy table (Passive Monitoring, Medium Deception, Full Environmental Simulation, Containment Sandbox). Because of this alignment, the RL agent will always produce a valid strategy level that the existing response generation modules can utilize without any changes made to them.

The RL agent runs concurrently with the deterministic hybrid profiler, functioning as a complementary policy refinement component instead of a substitution for the explainable control policy. The Q-table based policy can be analyzed based on the type of deception action performed based on threat actor behavior as shown in Fig. 8 below. Actors with low skills associated with reconnaissance behaviors are likely to receive passive monitoring and deceptive actions, while sophisticated attacks by advanced actors are expected to receive sandbox and simulation-based responses.

Fig. 8.

Learned Q-learning policy indicating optimal deception actions for typical attacker behavior after offline training.

Reward engineering and policy update

The reinforcement learning layer updates deception policy using tabular Q-learning governed by the Bellman update rule given in Eq. (3):

3

Here, the learning rate is configured to be α = 0.1, and the discount factor is γ = 0.9. The selection of actions occurs using the ε-greedy exploration mechanism that initially starts with exploration probability ε = 0.2, decreasing by 0.995 after every ten episodes to favor exploiting over exploring. The reward functions are constructed based on the time spent during attacker engagement, attack depth, progress in the kill chain process, and successful interactions with the honeytokens. Higher rewards correspond to longer lasting deception and more advanced attacks, while punishment occurs if attackers exit prematurely or become detected through fingerprinting.

For offline training, the value of ε was taken to be 0.3 and α was set to 0.15 in order to motivate exploration when learning the policy. Conversely, in real-world deployment, ε was set to 0.2, while α to 0.1 to increase exploitation of learned policies with minimal adaptation to exploration.

The objectives of reinforcement learning thus align with the objectives of deception, attacker engagement, and intelligence gathering. Figure 9 shows the convergence behavior of the learned policy during offline pre-training.

Fig. 9.

Convergence of Q-learning reward during offline pre-training, indicating the stabilization of the learned policy for deception after roughly 500 episodes.

Implementation

Technology stack

The system is built exclusively from Python 3.12 code and runs on a Linux system with Ubuntu 24.04 OS installed in Windows Subsystem for Linux 2 (WSL2). The list of external packages used forms the core technology stack. Cowrie (version 2.9.17), an open-source SSH honeypot, is launched in a Docker container based on the official cowrie/cowrie: latest image. Port 2222 of the honeypot is exposed to the host computer. The JSON output plugin of the Cowrie honeypot is activated through a mounted configuration file that sends all events to the AI engine in a host-mounted directory.

The machine learning component relies on the RandomForestClassifier model from scikit-learn, with parameters set to 100 trees, maximum depth 8, and balanced class weight to account for the inherent imbalance between benign and attack sessions. This model is saved to disk using joblib. All elements of the Q-table in the reinforcement learning layer are stored using NumPy. Before actual deployment, the Q-learning model experiences offline training based on 2000 simulation episodes within eight different attacker scenarios, which include script-kiddie probing attacks, scanning, credentials acquisition, fingerprinting, persistence efforts, lateral movements, advanced persistent threats, and probing. Offline training is used here to populate the Q-table using well-informed values associated with specific actions at initialization to avoid any randomness in initial strategy decisions. Thus, offline training provides a kind of warm start mechanism for the adaptive deception learning algorithm. This reward system has been created with the primary aim of favoring protracted engagement and intelligence gathering. Hence, the process of escalation towards the use of containment-oriented strategies is triggered only when there is an expectation that intelligence cannot be gained through further engagement.

Neo4j Graph Database, Version 2026.02.2 (Neo4j Inc., 2026) is run in a Docker container and accessed using the official neo4j Python driver over the bolt protocol on port 7687. The attack graph, session similarity edges, and quality score of deception using RL are written to Neo4j in real-time while processing sessions. The network deception fabric component uses Docker’s python SDK to create and run the decoy services in a docker container. The two decoys deployed on threat detection are nginx: latest, which serves as the web server, and linuxserver/openssh-server: latest, which serves as the ssh server. Routing within the network is done through Linux iptables nat rules programmed using the subprocess module.

The ML evaluator component uses matplotlib to create the confusion matrix, ROC curve, and feature importance PNGs. The NIDS datasets integration is done through the nids-datasets package to pull down UNSW-NB15^27,28 and CIC-IDS2017²⁹ datasets hosted on Hugging Face.

Random forest inference and scoring

The Random Forest classifier is trained on a synthetic dataset of 5000 cases covering five behaviors, namely: normal behavior, reconnaissance attackers, credential harvesters, system fingerprinters, and high volume mixed attackers, where the feature distribution of each category is designed in accordance with the four-dimensional behavioral feature space of the system, not the network features used for evaluation in other benchmark intrusion detection systems. The feature engine computes the number of occurrences for each incoming command in the session and not the categorization of each command separately. It must be noted that this computation process was chosen purposefully; specifically, individual commands do not provide enough information to differentiate between a curious normal user and a budding attacker, while a five or more commands session would provide reliable discriminative information. Thus, the predictor is triggered after five commands and uses the four feature counts as inputs. The classification metrics discussed here have been obtained through two separate settings of evaluation. The results for the benchmark classifiers have been acquired through Random Forest evaluation of the prepared datasets. On the other hand, live deployment results pertain to the whole deception framework performance in the process of live Cowrie session.

The predictor outputs a binary classification result and an associated implicit confidence score based on the number of votes for attack behavior among the decision trees. This confidence factor, which has been derived by using the Random Forest predictor, is provided to the FDDICalculator in the form of the multiplier known as PredictionConfidence. The FDDI factor is therefore directly proportional to classification confidence.

Within the extended version of the proposed system, Random Forest can also be re-trained using real network intrusions taken from the UNSW-NB15 datasets using nids_integrator. The UNSW-NB15 network flow features will be mapped into the four-dimensional feature space using a label-based mapping approach and statistical information such as source bytes, destination packets, and services. The re-trained machine learning model will be saved onto the disk as model.pkl and then loaded into the feature engine during the subsequent system initialization.

Reinforcement learning agent implementation

Before the deployment of the RL agent, the pre-training phase involves the simulation of eight attack vectors for 2000 episodes. Pre-training helps avoid random initialization of the policy during live operation and also allows the RL algorithm to adopt a warm start deception method. The Q-table is created using NumPy to represent the state–action pair values, where the Q-table takes the shape of 90 × 4. The reward generated by each session leads to updating of the Q-table, which also entails saving the learning policy values to disk after the update process. The reward function has been designed so that the system can maximize the duration of the attacker’s interaction and information acquisition. Therefore, the transition to containment strategies takes place when the amount of possible intelligence from further interaction decreases. Besides reward-based adaptation, Deception Quality Score (DQS) results from each session are also logged along with the rewards, thereby allowing correlation analysis of the learning policy and deception performance.

Mutation engine implementation

On the other hand, the mutation engine creates a unique yet consistent fake environment for each session by generating data using the same deterministic algorithm that takes the MD5 hash of the current session identifier as a seed input for the random number generation function. Such an implementation allows us to achieve both within-session and cross-session consistency and diversity at the same time: the former means that for each attack session, all commands see the same set of hostnames, kernels, and filesystems, whereas the latter guarantees that each session is presented with a different profile that cannot be correlated by Cowrie fingerprinting attacks.

Following are the system attributes that get mutated for each session: hostname (from a pool of possible combinations of prefixes and suffixes representing server names), Linux kernel version (randomly chosen from a pool of five kernel version strings), system uptime (randomized between 3 and 180 days), filesystem (random selection from a pool of realistic filename with realistic sizes and timestamp information), running processes (a collection of system processes with an additional randomly selected application process), network interfaces (random selection of subnet, host address, and MAC address), and last logon information (randomly selected IP address with a realistic date and time stamp).

All the above-mentioned information gets cached into a dictionary upon its creation in the beginning of each session. It ensures that all the future requests for a particular attribute are returned the same value.

Network monitoring implementation

The NIC monitor module serves as a layer of observation of the network hardware independently of the SSH application layer. Two methods are used for monitoring the network.

The first method gathers statistics on the number of bytes and packets transmitted via the interface using the Linux kernel-maintained virtual /proc/net/dev file. No need to access the file as root since the file updates itself regularly. The module reads the data from it every time a new command is executed, calculates the per-second rate of bytes and packets by subtracting two consecutive readings and dividing by time interval and alerts EXFILTRATION if the outgoing bandwidth of docker0 interface exceeds 500 kbps or PORT_SCAN if the incoming packets per second rate exceeds 100 pps. The second method performs the task of packet capture for each IP address on docker0 interface by using the Python-based Scapy library if the module is run with root privileges. The IP addresses are grouped according to their port numbers accessed in the last ten seconds and HIGH severity PORT_SCAN alert is raised if any of the IPs contact more than ten different ports.

In both cases, a structured alert dictionary is formed, including the type of the alert, the human-readable string detailing the event, a time-stamp value, and a severity level indicator. These alerts are printed out to the terminal of the engine in parallel with the output from each command’s pipeline.

Testing and evaluation approach

Evaluation takes place through functional testing, comparative benchmarking, and the generation of various metrics.

Function testing is done at the module level where the output of each individual module is tested for a known input. Testing of the feature engine involves passing to the feature engine a series of manually constructed commands with known expected classifications of the feature buckets. Testing of the hysteresis controller is performed with a sequence of risk scores crossing into each other’s range of thresholds and returning back, ensuring correct feedback delay and proper hysteresis. Mutation engine is tested through testing for two unique session identifiers with unique results and an identical session identifier producing identical results. Benchmarking against plain Cowrie is done via processing the exact same set of attacker sessions using two different pipelines at the same time. These include: baseline (plain) path, where only keyword matching takes place and static responses are returned; and full-fledged AI system path, where all stages of the twelve-stage pipeline are applied. Both pipelines process exactly the same input data, hence, direct comparison between metrics at the per-session level and aggregated levels can be done in terms of their results.

The ml_evaluator module provides statistical evaluation by calculating the following metrics based on the resulting confusion matrix and signals from content and intent stage classifiers: precision, recall, F1-score, accuracy, false positive rate, and AUC-ROC. These metrics along with confusion matrix and ROC curve are plotted into corresponding charts in PNG format to accompany this report. Deception success metrics such as session engagement time, command depth, kill chain success rate, information exfiltration rate, deception retention rate, and fingerprintability are calculated by this module as well.

Results and discussion

Experimental setup and evaluation framework

The proposed Explainability-Driven Adaptive Cyber Deception System is tested using attack interaction data obtained from a Cowrie SSH honeypot. However, it is necessary to emphasize that there were relatively few live sessions of Cowrie attackers during the period under study. Thus, the real-world experiments provide proof-of-concept validation of the proposed approach but do not represent statistically significant samples of attackers. Future work on larger samples of attackers will allow for testing of generalization and robustness properties. Ten varied attack scenarios covering each stage of the kill chain from reconnaissance to exfiltration were utilized for the main experiments, along with three regular user session data for comparative analysis. In addition to that, the UNSW-NB15 dataset was also leveraged for further training purposes. For consistency purposes, the same data set is used in both baseline and proposed approaches. The baseline approach uses the standard Cowrie honeypot with fixed responses and no adaptive intelligence. The proposed approach implements the use of machine learning, explainability-driven scoring, behavioral profiling, hysteresis control, and adaptive deception. It should be emphasized that the number of live Cowrie attacks used was restricted during the present period of deployment. In this sense, the conducted empirical studies may be regarded as proof of concept of the proposed end-to-end framework rather than statistically significant estimation of the size of attacker populations. Future research with the larger and geographically more diversified attacker populations would help to conduct a more generalized assessment.

Several evaluation metrics have been chosen to gauge the efficacy of the proposed cyber deception system. These metrics include classification accuracy, kill-chain stage identification, intelligence gathering per attack session, and honeypot fingerprintability.

Stochastic biases were controlled through multiple attacker sessions. The system was tested over 14 different attacker sessions during the first main benchmark test, while an additional 10 sessions of various types covering the whole spectrum of five stages of kill chain for ML classifier testing were conducted, bringing the total number of attacker session interactions analyzed using the pipeline to 24. The results are shown as averages obtained after multiple runs of the experiment. The variability between multiple runs was minimal, which is illustrated by the convergence of BCS scores across attacker sessions and stable classifier results—the random forest algorithm showed negligible variability in five-fold cross validation (F1 = 0.998 ± 0.002 on synthetic training dataset).

Comparative performance analysis

The results obtained indicate significant improvements in terms of all evaluation metrics relative to the baseline system. In terms of attack classification accuracy, the proposed honeypot obtains an accuracy rate of 90.0%, which is significantly higher compared to the baseline honeypot at 60.0%. These results suggest that the proposed behavioral feature-based attack classification strategy can be considered efficient.

Regarding the detection capability of the attacker’s location in the cyber kill chain, the results suggest that there was a marked difference between the two systems. While the baseline honeypot is not able to classify any attacks, thus leading to a 0% detection rate, the proposed system obtained a perfect detection rate of 100%. This result suggests that the proposed intent detection module for mapping command sequences to attack stages is highly efficient. One of the important metrics evaluated is the amount of threat intelligence collected per session. Compared to the baseline system, which obtains an average of 7.4 IOCs per session, the proposed system obtained an average of 13.4 IOCs per session, which represents an improvement rate of around 77.0%. This significant improvement was mainly due to its ability to conduct longer and more realistic sessions with attackers.

The most prominent enhancement is seen in honeypot fingerprinting. The baseline honeypot can easily be identified since it is completely static, but the proposed system observes no succesful fingerprinting. This is made possible by the mutation engine that makes sure each session runs under a unique but consistent environment. Table 9 presents the comparative results obtained by processing all 14 real attacker sessions through the plain Cowrie baseline path and the full AI system pipeline simultaneously.

Table 9.

Comparative results: plain Cowrie vs. AI honeypot system.

Metric	Plain Cowrie (baseline)	AI honeypot system	Improvement
Attack classification accuracy	60.0%	90.0%	+ 30% points
Kill-chain stage detection	0.0%	100.0%	+ 100% (was zero)
Avg. threat intelligence per session	7.4 IOCs	13.1 IOCs	+ 77.0%
Honeypot fingerprintability	100%	0%	–100% (fully eliminated)
Adaptive deception responses	No	Yes	New capability
Returning attacker detection	No	Yes (14 sessions, 1 IP)	New capability

Classification performance metrics

To get a more complete evaluation of the classification process, machine learning measures were calculated for the Random Forest classifier. It reached accuracy, precision, recall, and F1-score values of 90.0%, 100%, 85.7%, and 92.3%, respectively, suggesting balanced classification of malicious and normal user sessions. With recall being very high, this means that there were few cases when malicious sessions would pass unnoticed, whereas high precision means that the number of false positives was also quite low.

Receiver Operating Characteristic analysis further confirms the robustness of the classifier. As shown in Fig. 10, the ROC curve approaches the upper-left corner, demonstrating strong separability between malicious and benign classes. The high AUC value indicates the model retains discriminative power across varying classification thresholds.

Fig. 10.

ROC curve of random forest classifier.

Comparative positioning against existing adaptive deception frameworks

Whereas quantitative benchmarking on basic Cowrie illustrates the gains realized from the use of the proposed framework, qualitative comparison of the same to representative adaptive cyber deception strategies yields more information on the unique features of the proposed framework. The significant variation in implementation environments, conditions, and methods used to evaluate existing solutions rendered direct experimentation outside the scope of this research. Consequently, qualitative comparison of the proposed solution to the existing adaptive deception techniques was done. Hence, a qualitative comparison has been performed between the proposed framework and various existing methods of adaptive cyber deception, which have been presented in the literature, as illustrated in Table 10.

Table 10.

Qualitative comparison between the proposed framework and adaptive cyber deception approaches.

Framework	Explainable	Adaptive	Reinforcement learning	Environment mutation
Cowrie	No	No	No	No
CHIMERA (Islam et al., 2021)	No	Yes	No	Partial
Huang and Zhu (2020)	No	Yes	Yes	No
Proposed framework	Yes	Yes	Yes	Yes

The qualitative comparison illustrates the transition from fixed cyber deception systems towards more adaptable approaches. The existing honeypot systems, such as Cowrie, offer only fixed interaction capabilities and have no way to ensure the process of explanation of decision making, adaptation, and response optimization. Adaptive capabilities were first introduced in CHIMERA by means of probabilistic decision-making, but there was no use of explanation-driven scoring and reinforcement learning for strategic adaptation. At the same time, the system based on reinforcement learning suggested by Huang and Zhu provided adaptive response optimization but did not include any way of explanation of defensive actions or session consistent environment mutation. In the contrast, the proposed system combines together explainability-driven scoring (FDDI), consistency checking of behavior (BCS), adaptive control with hysteresis, reinforcement learning, and session consistent environment mutation in one framework.

Ablation analysis

Component-wise ablation was used in order to estimate the contribution of major framework components in terms of operational metrics by disabling individual modules while keeping the rest of the framework intact with regard to the evaluated Cowrie session data set. The focus is placed on adaptive deception behavior, extraction of threat intelligence, and strategy stability. The resulting performance variations for each ablation configuration are summarized in Table 11.

Table 11.

Ablation study of major framework components.

Configuration	Accuracy (%)	Avg threat intelligence per session	Avg strategy oscillations
Full framework	90.0	13.1	1.8
Without FDDI	90.0	13.1	0.9
Without BCS	90.0	13.1	0.9
Without hysteresis control	90.0	13.1	2.2

The findings show that elimination of either FDDI or BCS lowered the average number of strategy transitions per session from 1.8 to 0.9 and led to the convergence of the adaptive risk assignments to medium risk categories. It means that these components contribute mainly to risk discrimination and adaptive-response precision rather than to attacks classification accuracy.

Conversely, the elimination of the hysteresis controller elevated the average number of strategy oscillations per session from 1.8 to 2.2 and corresponded to approximately 22% increase in adaptive state instability. The findings confirm the efficiency of hysteresis-based control in preventing fast strategy transition and stability of deception behavior.

The absence of the observed changes in the attacks-classification accuracy implies that the main contribution of these modules is in adaptive deception control rather than in classifier performance.

Even though reinforcement learning and environment mutation are the core elements of the suggested framework, their importance is represented in the adaptive and interaction behaviors, which cannot be measured using replay metrics utilized in this ablation study.

Comparative evaluation against baseline Cowrie

A comparative assessment of our proposal versus a normal Cowrie deployment is shown in Fig. 11 where attack classification has been increased from 60.0% to 90.0%, detection of kill-chain stages is attained for all considered sessions, and the amount of threat intelligence is raised by 77.0%.

Fig. 11.

Performance comparison with plain Cowrie.

Kill-chain stage analysis

Upon analyzing the kill-chain stages detected by the system, it can be seen that Kill chain dissection for 10 sessions demonstrates that the total attack lifecycle from probe to exfiltration is well covered. The following distribution reveals that all five phases of the attack lifecycle are represented in the dataset: reconnaissance (3 sessions; 30%), exfiltration (3 sessions; 30%), exploitation (2 sessions; 20%), persistence (1 session; 10%), and lateral movement (1 session; 10%).

Such a distribution reflects the real-life situation in which a typical attacker starts with reconnaissance and only then tries to do anything else. It is also noteworthy that there is no presence of persistence, lateral movements, and exfiltration. Therefore, the data set collected here includes only the initial phases of an attack.

Even though this is a flaw, it does not prevent the system from accurately detecting all stages of the attack. Thus, the intent detection algorithm works well in identifying command sequences and matching them to attack stages.

Figure 12 illustrates confusion matrix performance of the classifier. True positive and true negative rates dominate the matrix, while false classifications remain limited. In particular, low false negative incidence is important in deception systems, since missed malicious sessions reduce adaptive response effectiveness.

Fig. 12.

Confusion matrix of random forest classification.

Behavioral pattern and session similarity analysis

The fusion of behavioral profiling with the use of session similarity helps to get a clearer understanding of attacker behavior in different sessions. The system calculates similarity values for each pair of sessions and finds strong correlations between them. Many session pairs have a similarity value greater than the set threshold. The results show that all fourteen sessions belong to one attacker because there is consistency in their behavior and the command pattern is identical in some sessions. Therefore, the system is capable of recognizing attackers based on the multi-session memory feature and the detection of similarities. In addition, the Behavioral Convergence Score is essential for differentiating structured behavior from random behavior. Sessions with a high value of the behavioral convergence score have a similar command pattern, which implies the presence of an attack strategy.

Discussion of system performance

The empirical evidence clearly shows that the developed cyber deception approach with the use of explainability is substantially superior to the baseline honeypot in terms of all the studied criteria. In addition to quantitative metrics, the noted improvement offers valuable insight into the capabilities of implementing behavioral modeling, explainable AI, and adaptive control for cyber protection. While temporal relationships in the stream of commands can be learned using sequence based models like Hidden Markov Models and LSTM (Long Short Term Memory) networks, the decision to use Random Forest was taken because of lower computational cost and high degree of explainability, as well as ability to work on behavioral data of relatively lower dimensionality. The new method focuses more on explainable control, where the contribution of features affects whether to deceive or not.

Firstly, the substantial enhancement in classification performance from 60.0% to 90.0% at the live session level proves the potential of moving from simple logging to the analysis based on behavioral models. Honeypots rely on the processing of individual commands, which implies that there is no semantic knowledge about attackers’ activities. The introduced approach generates a hierarchical structure of behaviors through the categorization and accumulation of commands over time. Feature importance analysis also bears testimony to this phenomenon. From among all the four categories of behavior, it was seen that those from the reconnaissance category and file access played a more crucial role in classification as compared to system information and auxiliary features. This is because of the fact that our threat model assumes that the behaviors in reconnaissance and file access play a more important role in command sequences. It is important to note that the aggregation of commands allows for tracking changes in attack vectors instead of focusing on specific incidents. Thus, the empirical findings confirm that even a small number of features can produce high classification accuracy provided that the chosen representation corresponds to the underlying behavioral domain. Additional demonstration of classifier interpretability is provided in Fig. 13, which highlights the relative importance of behavioral features. The Random Forest classifier ranks the most importance to reconnaissance and file-access related behavioral features, which is a strong indication that this category contributes significantly more to the decision process when classifying malicious sessions. On the other hand, system information and other auxiliary features appear to make less significant contributions to classification decision process. This trend is expected according to the proposed threat model because reconnaissance commands and file accesses should demonstrate better discrimination power in distinguishing normal sessions from adversaries.

Fig. 13.

Normalized contribution scores (feature importance) of the behavioral categories employed by the random forest classifier for attacker session classification.

A perfect kill-chain detection rate demonstrates the necessity of using contextual intelligence in contemporary cybersecurity solutions. Classic honeypots do not have such an opportunity as their intentionality detection features are not developed; however, with the use of the kill-chain-based intent engine, a mapping of commands to attack intentions can be achieved. From the moment the security system is capable of interpreting an attack process in terms of its intentions, it becomes more advanced and effective at dealing with attackers depending on the particular stage of their activity.

The inclusion of the Feature Dominance Deception Index is key in ensuring that explainability becomes an important determinant of how the system makes its decisions. Through the computation of FDDI by taking the multiplication of the probability of predicting a deception and the weighted sum of the features of the behavioral components, the system is guaranteed to escalate in deception based on the evidence and level of confidence in making the classification. The multiplicative formula guarantees that the system does not escalate too soon at the beginning of the session due to lack of certainty in making predictions.

Furthermore, the Behavioral Convergence Score increases the efficiency of the system by adding a notion of temporal consistency into the profiling of attackers. By estimating the behavioral deviations during various interactions with the system, the system can distinguish between targeted, carefully thought out attacks from random activities and automated programs. The former are often more advanced and therefore can be met with a stronger and smarter deception tactics than those that are less consistent.

The lack of fingerprintability of the honeypots stands out as one of the most valuable contributions of this work. While traditional honeypots cannot be considered secure because of their static nature, making them detectable by an intelligent attacker, the mutation engine provides a solution to this problem. Session-based dynamic environment creates a challenge for any attacker, since it is not possible to detect it.

The rise in the volume of threat intelligence gained per session is an indicator of the effectiveness of the adaptive deception approach. Through continuous realistic and situational awareness-based interactions, it is possible to push attackers into disclosing more of their modus operandi. The increased interactivity results in larger datasets that can be used to analyze the threats faced by the organization. However, the use of DQS introduces an objective way of gauging the realism of the deception and the quality of engagement that does not exist in traditional honeypot research. Instead of measuring the realism of the deception based solely on the intelligence gained from the attacker, DQS determines whether the deception remains strategically realistic to the attacker.

In addition to the volume of collected intelligence, deception performance was measured using a metric known as the Deception Quality Score (DQS). As shown in Fig. 14a, session-level DQS consists of the following weighted factors: engagement duration, command depth, escalation of kill chain phase, and honeytoken interaction. The consistency of the contributions across sessions reflects reliable deception quality, rather than any exceptional cases. Additionally, in Fig. 14b, the effect of command depth on the DQS for each kill chain phase can be observed. In general, sessions related to deeper exploitation efforts tend to have higher DQSs, thus indicating that a greater level of attacker engagement leads to better deception results. Most of the sessions have scores in the fair-to-good range.

Fig. 14.

Analysis of Deception Quality Score (DQS) across attack sessions. (a) Decomposition of the weighted components of DQS in each attack session including engagement time, command depth, escalation of the kill chain stage, and honeytoken usage. (b) Effect of DQS on command depth with deception quality limits.

Besides the deception-quality performance, the convergence characteristics of the reinforcement learning layer were determined using the total rewards per episode in the 2000 pre-training sessions. From Fig. 15, it is seen that the reward for each episode grows initially and eventually becomes constant at the high-reward level, which confirms the convergence of the trained policy. Even though there are still some fluctuations due to the ongoing exploration process and randomness in state transitions, the rolling average reveals the convergence of the reward after about 700 episodes.

Fig. 15.

Reward convergence of the Q-learning agent within 2000 episodes of training.

Thus, the convergence explains the average session reward value of about + 14.0 and means that the adaptive response selection results from the optimization of learned policies, not randomly chosen actions.

The hysteresis-based control technique improves the stability of the deception system by ensuring that it does not make rapid and recurrent switches among deception approaches. It would be counterproductive when operating in a changing environment since the frequent changes affect the level of realism.

The findings show that the suggested solution marks the transition from the traditional data gathering approach to an intelligent cyber defense strategy. The achieved progress does not rely on one specific element but emerges as a result of a combination of various techniques, such as machine learning, explainability, behavioral modeling, and adaptive control.

Performance of reinforcement learning agent

The agent underwent pre-training over 2000 episodes in order to reach an average reward of 64.26 per episode, which means the Q-table is properly converged. The findings obtained through policy sanity check indicated that the agent chose the proper deception move for all eight attacks and all scenarios had OKAY status. The reason behind the increase in the number of episodes compared to the initial setup lies in the new FDDI formula: multiplication provides a lower value for FDDI compared to the division formula used previously, meaning there is a smaller range of the state space to be trained. However, the former response, despite being cautious, is not a wrong approach considering the applicability of the technique in dealing with credential access behaviors.

When tested during actual session execution, the agent gained a total session reward of + 14.0 on an 8-command exploitation session lasting 59.3 s. The Q-table had already acquired 21 visited values among 360 possible cells (90 states * 4 actions) after several live trials because of more efficient and accurate state space exploration thanks to the improved FDDI equation. At the end of session execution, the Q-values in the Q-table recognized that the optimal move was to use Containment Sandbox, as indicated by its value of 12.65. The overall average response time for all pipeline stages was 294.4 ms, where the first-command latency value of 2228.9 ms was because of Docker decoy container initialization, which occurs only once per session. The following commands had an average response time of 18 ms, indicating that the RL layer introduces insignificant computational costs into the system.

Metrics of deception success

In addition to conventional classification metrics, a deception success assessment framework was applied for quantifying the effectiveness of the system as a deception platform. The following metrics were calculated during all 10 performed sessions:

The average Engagement Duration (ED) per session is 61.47 s. It denotes the amount of time when attackers stayed in the deception environment. The average value of Command Depth (CD) per session is 11.50 commands. This metric shows that there is high attacker interaction with the environment. The Kill-Chain Completion Rate (KCR) equals 100%. It means that each session has been mapped to some kill-chain stage. The Information Extraction Rate (IER) equals 9.70 IOCs. The Deception Retention Rate (DRR) is 100% that shows that none of attackers left the environment being suspicious – the mutation engine successfully protects the system from fingerprint detection. Fingerprintability Score (Fp) equals 0.0000.

The DQS value for the representative session based on the engagement time score of 0.54, command depth score of 0.33, stage escalation score of 0.33, and honeytoken access score of 0.00 is 0.327 (Fair). The reduced values for the command depth and stage escalation scores can be attributed to the conservative FDDI approach to deception using the multiplicative formula. Lack of honeytoken triggering during the sessions suggests making some improvements regarding future deployments by planting honeytokens on early stages of deception response.

Parameter sensitivity analysis

Sensitivity analysis was performed on the suggested model to examine its robustness concerning important parameters such as FDDI threshold values, hysteresis cooldown time period, and reinforcement learning parameters. Moderate fluctuations in the threshold parameters (± 10%) showed minimal effects on the frequency of escalating deception strategies, demonstrating that the control mechanism of the system was quite stable against the threshold variation.

In the case of the reinforcement learning stage, α and γ parameters sensitivity was analyzed for the specified ranges of values α = 0.1 and γ = 0.9. Lower values of α led to slower convergence rates; however, higher α values generated instabilities within the reward accumulation process.

Limitations and future considerations

While considering the remarkable advancements made in this research, there are several limitations to the suggested solution that must not be ignored. The testing process has been performed using a modest data set containing only fourteen sessions created by one attacker. Even though the provided data set represents realistic attacks quite accurately, it has not covered various aspects, such as diverse attacker profiles and different types of attacks as well as environments. Despite the removal of fingerprintability during testing, further research is necessary regarding the resistance of the honeypots against active fingerprinting schemes. The second limitation pertains to the coverage of the proposed solution. In other words, at the moment the solution covers only SSH-based interactions, whereas today’s attackers usually conduct multi-protocol attacks involving SSH, HTTP, FTP, etc.

Another possible limitation associated with the usage of the synthetically generated dataset for training purposes involves potential restrictions. Despite the fact that the dataset is intended to be consistent with the characteristics of the considered feature space and follows existing benchmark standards, such as the KDD dataset, it might not adequately represent the dynamics of attacks in the real world. In addition, the functioning of the proposed system is characterized by a static set of behavioral classes and corresponding weighting coefficients used to calculate explainability scores. Such an approach allows for efficient computing and guarantees timely performance; however, it does not provide sufficient flexibility to address emerging attack types.

The research can be furthered by looking at ways to overcome these challenges through extending the database to include more varied attacker behavior captured over a larger period of time. Adding more protocol capabilities will increase the flexibility of the model. Adding the functionality of online learning will help the model learn new attack patterns and evolve its performance. Improvements can also be made in terms of defining the feature space and adjusting the weights of the behavioral factors.

Although the RL agent’s Q-table shows convergence during pre-training, there is inadequate state exploration in the deployment phase because of the few training sessions used. The need for a larger data set will facilitate better exploration of the Q-table space and policy optimization. Furthermore, the reward structure for the reinforcement learning does not include penalties when the detection of the attack is achieved; this can be implemented in future work. Future research may also explore calibration analysis and cross-validation in larger groups of attackers to enhance generalizability of the classification metrics.

Conclusion

In this study, an Explainability-Driven Adaptive Cyber Deception Control System was proposed to improve upon traditional honeypots through the implementation of machine learning, behavioral profiling, and adaptive control techniques. The system analyzes attacker actions dynamically and utilizes explainability-driven criteria including the Feature Dominance Deception Index (FDDI) and Behavioral Convergence Score (BCS) for guiding deception. The experimental results show a marked improvement in terms of attack categorization, intention determination, and information gathering, and honeypot detectability was completely removed. Hysteresis-based control was implemented to stabilize decision-making, and the graph-based intelligence layer allowed for multi-session tracking and the identification of recurrent attackers.

These results indicate the practical value of the approach, showing how traditional honeypots could be enhanced and evolve into intelligent and adaptive cyber defense systems capable of understanding their environment. This would allow for more efficient engagement with attackers and better long-term threat assessment. The ethical aspect was included in the design by restricting all activities related to deception strictly within the boundaries of the decoy environment. The deception system engages in passive defense and diversion, but does not engage in counterattacks or any other communication outside the sandbox. Building upon the limitations identified in “ Metrics of deception success”, future research will include large-scale verification using attackers from different geographic locations, generalization of the proposed approach for multi-protocol settings, integration of online learning approaches, improvement of the explainability-based behavior scoring algorithm, and evaluation of reinforcement learning strategies through better state space exploration and rewards optimization. The addition of the Reinforcement Learning adaptive layer is a substantial enhancement of the initial system, which uses the encoding of pipeline signals to discrete states and Q-table learning for optimal deceptive actions to move from being a fixed policy-based adaptive system to a learning cyber deception system. The concept of Deception Quality Score is proposed as an additional metric quantifying the quality of deception along with the traditional classification measures used. Both improvements together fill the research gap identified in the literature – the lack of a learning, adaptive, and explainable cyber deception system validated with real attackers’ data.

Author contributions

All authors, viz. S.D.R., G.K., S.C. equally contributed to each section.

Funding

Open access funding provided by Vellore Institute of Technology. Funding for this research is provided by VIT University.

Data availability

The dataset used for this study is publicly available on https://research.unsw.edu.au/projects/unsw-nb15-dataset, https://www.unb.ca/cic/datasets/ids-2017.html.

Declarations

Competing interests

The authors declare no competing interests.

Research involving human and/or animals

No human and/or animals are involved in this research.

Informed consent

Consent has been taken from everyone who is involved in this research.