AEGIS-AI: Autonomous Threat Deception and Detection Using Honeypot Networks

The development of adaptive and intelligent defense mechanisms will require new approaches to defending against sophisticated cyber threats that can't be fully supported by existing intrusion detection (ID) systems. AEGIS-AI: A Framework for Autonomous Threat Deception and Detection is an autonomous framework based on both honeypots and reinforcement learning (RL) combined with deep neural networks (DNNs) to automate the way honeypots are employed as a deception technique for detecting and responding to malicious activity. The ability to change deception strategies in real time according to the attacker's behaviour is a key feature of AEGIS-AI. The dynamic deception strategy can be generated from an analysis of attacker's behaviour at any point in time using a Markov Decision Process (MDP) approach to provide optimal responses. The honeypots are subdivided into multi-service honeypots having different interactive capabilities, and the AI engine automatically coordinates the application of the deception techniques being employed as well as continuously improving them using Qlearning and anomaly detection-based models. The performance of the AEGIS-AI framework was evaluated against the CICIDS-2017 and Honeypot Datasets Customized for Your Organization Indicate an Accuracy Of 97.8% In Identifying Intrusions with A 1.4% Chance of False Positives and An Average Time Spent Engaging an Attacker with The System Of 520 Seconds. Thus, Custom Honeypot Datasets Outperform Previous (Static & Semi-Adaptive) Honeypot Baseline Performance by A Large Margin. The Use of Federated Learning to Share Threat Intelligence Across Multiple Geographically Dispersed Deployments While Maintaining Data Privacy Has Also Been Incorporated into The Framework. Additionally, The Paper Provides Mathematical Formulas for Evaluating the Effectiveness of Deception-Based Approaches to Honeypots, For Placing Game Theoretic Honeypots, And for Optimizing Resources Used in Maintaining a Honeypot System.