Network- and Device-Level Cyber Deception for Contested Environments Using RL and LLMs

2026-03-17

AI Summary

This work proposes a novel framework that integrates large language models (LLMs) with reinforcement learning (RL) to generate adaptive, intelligent deception strategies at both network and device levels—an approach not previously achieved. Addressing the limitations of traditional deception techniques, which are often costly, static, and reliant on manual intervention, the proposed method leverages containerization and operational technology (OT) security architectures to autonomously optimize and dynamically deploy deception mechanisms within simulated adversarial environments. Experimental results demonstrate that the framework significantly enhances defensive capabilities against stealthy attacks by improving deception efficacy while substantially reducing operational costs. The approach achieves high detection accuracy and superior cost-effectiveness, offering a scalable and intelligent solution for modern cyber defense.

Technology Category

• Search and Optimization: Learning to Search
• Machine Learning: Adversarial Learning & Robustness
• Intelligent Robots: Learning & Optimization for ROB

Application Category

• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Cyber deception assists in increasing the attacker's budget in reconnaissance or any early phases of threat intrusions. In the past, numerous methods of cyber deception have been adopted, such as IP address randomization, the creation of honeypots and honeynets mimicking an actual set of services, and networks deployed within an enterprise or operational technology(OT) network. These types of strategies follow naive approaches of recreating services that are expensive and that need a lot of human intervention. The advent of cloud services and other automations of containerized applications, such as Kubernetes, makes cyber defense easier. Yet, there remains a lot of potential to improve the accuracy of these deception strategies and to make them cost-effective using artificial intelligence (AI)-based solutions by making the deception more dynamic. Hence, in this work, we review various AI-based solutions in building network- and device-level cyber deception methods in contested environments. Specifically, we focus on leveraging the fusion of large language models (LLMs) and reinforcement learning(RL) in optimally learning these cyber deception strategies and validating the efficacy of such strategies in some stealthy attacks against OT systems in the literature.

Problem

• cyber deception
• contested environments
• operational technology
• stealthy attacks
• dynamic defense

Innovation

• cyber deception
• large language models
• reinforcement learning
• contested environments
• OT security