{"id":"https://openalex.org/W7155827872","doi":"https://doi.org/10.21203/rs.3.rs-9065129/v1","title":"AI-Driven Cyber Deception: A Reinforcement Learning Honeypot Framework with Threat Intelligence and Automated Containment","display_name":"AI-Driven Cyber Deception: A Reinforcement Learning Honeypot Framework with Threat Intelligence and Automated Containment","publication_year":2026,"publication_date":"2026-04-27","ids":{"openalex":"https://openalex.org/W7155827872","doi":"https://doi.org/10.21203/rs.3.rs-9065129/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-9065129/v1","doi":"https://doi.org/10.21203/rs.3.rs-9065129/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-9065129/v1","pdf_url":"https://www.researchsquare.com/article/rs-9065129/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.researchsquare.com/article/rs-9065129/latest.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089095327","display_name":"Iqra Hussain","orcid":"https://orcid.org/0000-0002-5458-3331","observed_orcids":["https://orcid.org/0000-0002-5458-3331"]},"institutions":[{"id":"https://openalex.org/I91044093","display_name":"Zayed University","ror":"https://ror.org/03snqfa66","country_code":"AE","type":"education","lineage":["https://openalex.org/I91044093"]}],"countries":["AE"],"is_corresponding":true,"raw_author_name":"Iqra Hussain","raw_affiliation_strings":["Zayed University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zayed University","institution_ids":["https://openalex.org/I91044093"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028958422","display_name":"Monther Aldwairi","orcid":"https://orcid.org/0000-0003-1150-2404","observed_orcids":["https://orcid.org/0000-0003-1150-2404"]},"institutions":[{"id":"https://openalex.org/I91044093","display_name":"Zayed University","ror":"https://ror.org/03snqfa66","country_code":"AE","type":"education","lineage":["https://openalex.org/I91044093"]}],"countries":["AE"],"is_corresponding":false,"raw_author_name":"Monther Aldwairi","raw_affiliation_strings":["Zayed University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zayed University","institution_ids":["https://openalex.org/I91044093"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5046570686","display_name":"Azka Wani","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I91044093","display_name":"Zayed University","ror":"https://ror.org/03snqfa66","country_code":"AE","type":"education","lineage":["https://openalex.org/I91044093"]}],"countries":["AE"],"is_corresponding":false,"raw_author_name":"Azka Wani","raw_affiliation_strings":["Zayed University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zayed University","institution_ids":["https://openalex.org/I91044093"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5089095327"],"corresponding_institution_ids":["https://openalex.org/I91044093"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9771000146865845,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9771000146865845,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0071000000461936,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.0044999998062849045,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cyber-deception","display_name":"cyber deception","score":0.7860000133514404},{"id":"https://openalex.org/keywords/honeypots","display_name":"honeypots","score":0.9660000205039978},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"reinforcement learning","score":0.8539999723434448},{"id":"https://openalex.org/keywords/q-learning","display_name":"Q-learning","score":0.7820000052452087},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.7940000295639038},{"id":"https://openalex.org/keywords/threat-intelligence","display_name":"threat intelligence","score":0.6940000057220459},{"id":"https://openalex.org/keywords/indicators-of-compromise","display_name":"indicators of compromise","score":0.9760000109672546},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.6169999837875366},{"id":"https://openalex.org/keywords/sql-injection","display_name":"SQL injection","score":0.5879999995231628},{"id":"https://openalex.org/keywords/port-scanning","display_name":"port scanning","score":0.7549999952316284},{"id":"https://openalex.org/keywords/brute-force-attacks","display_name":"brute force attacks","score":0.6140000224113464},{"id":"https://openalex.org/keywords/command-injection","display_name":"command injection","score":0.6629999876022339},{"id":"https://openalex.org/keywords/corporate-security","display_name":"enterprise security","score":0.4569999873638153}],"concepts":[{"id":"https://openalex.org/C2779267917","wikidata":"https://www.wikidata.org/wiki/Q170028","display_name":"Deception","level":2,"score":0.7541000247001648},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7074000239372253},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6389999985694885},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.5430999994277954},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.4950000047683716},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.41359999775886536},{"id":"https://openalex.org/C2777019822","wikidata":"https://www.wikidata.org/wiki/Q390066","display_name":"Containment (computer programming)","level":2,"score":0.4117000102996826},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3968999981880188},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.39309999346733093},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.3619999885559082},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.35440000891685486},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.35040000081062317},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.34450000524520874},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.3352000117301941},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.2971000075340271},{"id":"https://openalex.org/C2781133158","wikidata":"https://www.wikidata.org/wiki/Q1088669","display_name":"Survivability","level":2,"score":0.2897999882698059},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.28189998865127563},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2768999934196472},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.2702000141143799},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.26910001039505005},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.26669999957084656},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.2574999928474426},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.2572999894618988},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.25}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.21203/rs.3.rs-9065129/v1","doi":"https://doi.org/10.21203/rs.3.rs-9065129/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-9065129/v1","pdf_url":"https://www.researchsquare.com/article/rs-9065129/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-9065129/v1","doi":"https://doi.org/10.21203/rs.3.rs-9065129/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-9065129/v1","pdf_url":"https://www.researchsquare.com/article/rs-9065129/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7155827872.pdf","grobid_xml":"https://content.openalex.org/works/W7155827872.grobid-xml"},"referenced_works_count":17,"referenced_works":["https://openalex.org/W1903377156","https://openalex.org/W2082135129","https://openalex.org/W2112675663","https://openalex.org/W2797887368","https://openalex.org/W2892859754","https://openalex.org/W2911966664","https://openalex.org/W2942521954","https://openalex.org/W2968538311","https://openalex.org/W3204342889","https://openalex.org/W4240189562","https://openalex.org/W4281253703","https://openalex.org/W4392364798","https://openalex.org/W4402991535","https://openalex.org/W4403995323","https://openalex.org/W4404600696","https://openalex.org/W7116975680","https://openalex.org/W7139985584"],"related_works":["https://openalex.org/W7161159531","https://openalex.org/W4417402919","https://openalex.org/W4409431206","https://openalex.org/W7139941506","https://openalex.org/W7206162987","https://openalex.org/W7168374026","https://openalex.org/W7218699433","https://openalex.org/W7203723469","https://openalex.org/W7140118555","https://openalex.org/W7111041251"],"abstract_inverted_index":{"Abstract":[0],"Honeypots":[1],"are":[2],"widely":[3],"used":[4],"cyber-deception":[5],"tools":[6],"for":[7,208,221],"diverting":[8],"adversaries":[9],"and":[10,19,26,63,75,89,93,125,182,205,214],"collecting":[11],"behavioral":[12],"telemetry,":[13],"yet":[14],"most":[15],"deployments":[16],"remain":[17],"static":[18,160],"increasingly":[20],"easy":[21],"to":[22,87,158,177,185],"fingerprint,":[23],"limiting":[24],"engagement":[25],"reducing":[27],"the":[28,71,138,150],"quality":[29],"of":[30,84,168],"collected":[31],"intelligence.":[32],"A":[33,171],"dynamic":[34],"AI-powered":[35],"honeypot":[36],"framework":[37,104,139],"is":[38,105,175,188,198,206],"proposed":[39],"that":[40,68,98],"integrates":[41],"three":[42],"capabilities":[43],"into":[44,225],"a":[45,51,58,108,126,131,145,159,166,191,218],"single":[46],"closed-loop":[47],"defense":[48],"pipeline:":[49],"(i)":[50],"reinforcement-learning":[52],"(RL)":[53],"deception":[54,91,180,224],"agent,":[55],"formalized":[56,176],"as":[57,190],"Markov":[59],"Decision":[60],"Process":[61],"(MDP)":[62],"trained":[64],"via":[65],"tabular":[66],"Q-learning,":[67],"continuously":[69],"adapts":[70],"honeypot's":[72],"exposed":[73],"persona":[74],"interaction":[76],"tactics;":[77],"(ii)":[78],"real-time":[79],"threat-intelligence":[80],"fusion":[81],"using":[82],"Indicators":[83],"Compromise":[85],"(IoCs)":[86],"contextualize":[88],"guide":[90],"decisions;":[92],"(iii)":[94],"automated":[95],"containment":[96],"actions":[97],"reduce":[99],"time-to-response":[100],"after":[101],"detection.":[102],"The":[103,195],"evaluated":[106],"in":[107,130],"virtualized,":[109],"isolated":[110],"testbed":[111],"across":[112,211],"five":[113],"representative":[114],"adversarial":[115],"behaviors:":[116],"SSH":[117],"brute-force,":[118],"port":[119],"scanning,":[120],"command":[121],"injection,":[122,124],"SQL":[123],"multi-stage":[127],"intrusion":[128],"culminating":[129],"Meterpreter":[132],"session.":[133],"Across":[134],"193":[135],"labeled":[136],"sessions,":[137],"achieves":[140],"97\\%":[141],"detection":[142],"accuracy":[143],"with":[144],"3.8\\%":[146],"false-positive":[147],"rate,":[148],"extending":[149],"mean":[151,167],"attacker":[152],"dwell":[153],"time":[154],"by":[155],"4.4\u00d7":[156],"compared":[157],"baseline":[161],"while":[162],"containing":[163],"threats":[164],"within":[165],"1.9":[169],"seconds.":[170],"Deception":[172],"Index":[173],"(DI)":[174],"quantify":[178],"adaptive":[179,223],"efficiency,":[181],"Mean":[183],"Time":[184],"Containment":[186],"(MTTC)":[187],"introduced":[189],"standardized":[192],"response":[193],"metric.":[194],"modular":[196],"architecture":[197],"validated":[199],"on":[200],"an":[201],"enterprise-grade":[202],"VMware":[203],"stack":[204],"designed":[207],"broad":[209],"deployment":[210],"cloud,":[212],"enterprise,":[213],"IoT":[215],"environments,":[216],"offering":[217],"replicable":[219],"template":[220],"integrating":[222],"operational":[226],"security":[227],"workflows.":[228]},"counts_by_year":[],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-04-28T00:00:00"}