An Autonomous AI-Driven Framework for Adaptive Cyber Deception with Real-Time Threat Detection and Behaviour-Based Attribution

Contemporary cyber threats increasingly employ multi-stage and behaviourally adaptive strategies that challenge static intrusion detection and non-adaptive deception mechanisms. Existing approaches typically treat threat detection, deception deployment, and adversarial attribution as separate functions, limiting timely response and underusing the behavioural evidence generated during attacker interaction. This study develops and evaluates a theory-informed computational and operational framework for autonomous cyber deception. The principal research artefact is a reusable closed-loop architecture rather than a single predictive model: it specifies the interacting components, interfaces, data and control flows, decision rules, and feedback mechanisms that connect detection, deception, telemetry, and attribution. Methodologically, the study follows an engineering design-and-evaluation approach comprising problem and requirement identification from the literature, architectural synthesis, component-level mathematical modelling, prototype implementation, and controlled cyber-range evaluation. In this context, modelling refers to the distinct computational models embedded within the framework: a hybrid detection model combining supervised classification, anomaly detection, and temporal sequence analysis; a Markov Decision Process and reinforcement-learning policy model for selecting and reconfiguring deception actions under engagement, intelligence-gain, resource, and containment objectives; and similarity-based and Bayesian attribution models for estimating MITRE ATT&CK techniques from incomplete behavioural evidence. The component models were developed offline using the NSL-KDD, CICIDS2017, UNSW-NB15, and ToN-IoT datasets, while the integrated prototype was evaluated separately in a controlled enterprise-like cyber range using reconnaissance, brute-force, exploitation, and multi-stage attack scenarios. The reported classification metrics were calculated from the labelled cyber-range evaluation events, not by pooling the four benchmark datasets. On this integrated cyber-range evaluation set, the system achieved 95.4% detection accuracy, 93.6% precision, 94.7% recall, and a 94.1% F1-score, with a mean detection latency of 85 ms. It also achieved 100% honeypot deployment reliability, 92% dynamic reconfiguration success, 88% fingerprinting resistance, and attacker engagement durations of up to 280 s. The attribution component demonstrated end-to-end generation of ATT&CK-aligned technique hypotheses from deception-derived telemetry; however, the present archived evaluation does not support per-technique or baseline-comparative performance claims. These findings show that specialised models and operational services can be coordinated within a unified adaptive defence process, while also identifying the additional class-level and ablation evidence required for rigorous attribution validation.