Panem Charanarur

As financial ecosystems migrate toward an architecture composed of autonomous software agents representing banks, telecom operators, payment processors, and end users. The communication channels between these agents become high-value targets for adversarial exploitation. Conventional fraud detectors operate on transaction-level attributes such as amount and type, and are blind to the behavioural signatures embedded in inter-agent message exchange. This paper proposes a detection framework that extracts twelve communication behavioral features (response time, message length, retry count, session anomaly score, authentication failure rate, interaction frequency, and others) from agentto-agent (A2A) traffic and feeds them through a two stage pipeline: (i) an autoencoder trained exclusively on legitimate interactions to produce an eight dimensional latent embedding and a scalar reconstruction error anomaly score, and (ii) an XGBoost classifier that operates on the 21 dimensional fusion of raw and autoencoder derived features. We evaluate the system on PaySim, a widely used financial dataset containing 6.36 million records, under a deliberately balanced protocol (50/50 fraudlegitimate split) that avoids the metric inflation common in imbalanced evaluations. Across six distinct attack types : (i) impersonation (ii) prompt injection (iii) collusion (iv) trust-chain exploitation (v) data exfiltration, and (vi) transaction manipulation. The proposed framework attains an F1-score of 0.933, AUC-ROC of 0.983, and per-attack F1 ranging from 0.928 (collusion, the stealthiest category) to 1.000 (transaction manipulation). A complementary four-tier graduated mitigation strategy (Monitor/Throttle/Quarantine/Block) achieves 93.52% fraud prevention, marginally exceeding binary blocking (93.27%) while reducing friction for legitimate users by 30%. We discuss the implications for emerging agent-to-agent (A2A) ecosystems expected in 2028 and beyond, in which autonomous AI agents will negotiate, transact, and settle on behalf of human principals without direct human oversight.

Cyber threats have increased in sophistication and complexity, and traditional perimeter security defenses are failing to stop advanced persistent threats, zero-day attacks, and targeted intrusion attacks. The project aims to design, implement, and test an AI-powered Cyber Deception System. It is a proactive cybersecurity system that includes honeypot emulation, threat classification with machine learning, unsupervised anomaly detection and reinforcement learning based deception strategy adaptation in a single deployment that requires limited resources. The system will deploy 4 honeypot services: SSH, HTTP, FTP, Telnet. These services monitor the attacker's actions without revealing any production resources. Each source IP is given a behavioural fingerprint and passed on to a Random Forest classifier which classifies attack traffic into five categories: brute-force, reconnaissance, exploitation, lateral movement, and data exfiltration. It is accompanied by another anomaly detector called Isolation Forest for the detection of unknown attack patterns (zero-day and out-of-distribution) that are not present in the training data of the classifier. A composite threat score will add the confidence levels of the classifiers, the magnitude of the anomaly, how often it occurs in the behaviour and the recurrence signals for each attacker IP and can help prioritise responses according to the risk. A Q-Learning reinforcement learning agent selects a strategy from a catalogue of seven deception strategies. The agent learns the strategies that most help the attacker to spend more time during simulated engagement episodes. It shows consistent improvement in rewards as training continues.