<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Article Tag Suite 1.1//EN"
  "https://jats.nlm.nih.gov/publishing/1.1/JATS-journalpublishing1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:mml="http://www.w3.org/1998/Math/MathML"
         article-type="Research Paper"
         xml:lang="en">
  <front>
    <journal-meta>
      <journal-title-group>
        <journal-title>NFSU Journal of Forensic Science</journal-title>
        <abbrev-journal-title abbrev-type="publisher">nfsujfs</abbrev-journal-title>
      </journal-title-group>
      <issn pub-type="epub">3049-2408</issn>
      <publisher>
        <publisher-name>Prof. (Dr.) Naveen Kumar Chaudhary</publisher-name>
      </publisher>
    </journal-meta>
    <article-meta>
      <article-id pub-id-type="publisher-id">nfsujfs330059</article-id>
      <title-group>
        <article-title>Self-Adapting Enterprise Threat Intelligence tool with Automated Deception and Real-Time Cyber Defense</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <name>
            <surname>Wagh</surname>
            <given-names>Deepkumar</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
        </contrib>
        <contrib contrib-type="author">
          <name>
            <surname>Panem Charanarur</surname>
            <given-names>Dr.</given-names>
          </name>
          <xref ref-type="aff" rid="aff2"/>
        </contrib>
      </contrib-group>
      <aff id="aff1">National Forensic sciences university</aff>
      <aff id="aff2">National Forensic Sciences university</aff>
      <pub-date pub-type="epub" iso-8601-date="2026-09-24">
        <month>09</month>
        <day>24</day>
        <year>2026</year>
      </pub-date>
      <volume>3</volume>
      <issue>4</issue>
      <fpage>53</fpage>
      <lpage>59</lpage>
      <abstract>
        <p>Cyber threats have increased in sophistication and complexity, and traditional perimeter
security defenses are failing to stop advanced persistent threats, zero-day attacks, and targeted
intrusion attacks. The project aims to design, implement, and test an AI-powered Cyber
Deception System. It is a proactive cybersecurity system that includes honeypot emulation,
threat classification with machine learning, unsupervised anomaly detection and reinforcement
learning based deception strategy adaptation in a single deployment that requires limited
resources. The system will deploy 4 honeypot services: SSH, HTTP, FTP, Telnet. These
services monitor the attacker&apos;s actions without revealing any production resources. Each source
IP is given a behavioural fingerprint and passed on to a Random Forest classifier which
classifies attack traffic into five categories: brute-force, reconnaissance, exploitation, lateral
movement, and data exfiltration. It is accompanied by another anomaly detector called
Isolation Forest for the detection of unknown attack patterns (zero-day and out-of-distribution)
that are not present in the training data of the classifier. A composite threat score will add the
confidence levels of the classifiers, the magnitude of the anomaly, how often it occurs in the
behaviour and the recurrence signals for each attacker IP and can help prioritise responses
according to the risk. A Q-Learning reinforcement learning agent selects a strategy from a
catalogue of seven deception strategies. The agent learns the strategies that most help the
attacker to spend more time during simulated engagement episodes. It shows consistent
improvement in rewards as training continues.</p>
      </abstract>
      <kwd-group kwd-group-type="author">
        <kwd>Cyber Deception</kwd>
        <kwd>Honeypot</kwd>
        <kwd>Machine Learning</kwd>
        <kwd>Random Forest</kwd>
        <kwd>Isolation
Forest</kwd>
        <kwd>Reinforcement Learning</kwd>
        <kwd>Q-Learning</kwd>
      </kwd-group>
    </article-meta>
  </front>
  <body>
    <!-- Full article body not available in metadata-only JATS export. See PDF/HTML galley. -->
  </body>
  <back/>
</article>
