Network and Device Level Cyber Deception for Contested Environments Using RL and LLMs

• URL: http://arxiv.org/abs/2603.17272v2
• Date: Thu, 19 Mar 2026 02:16:17 GMT
• Title: Network and Device Level Cyber Deception for Contested Environments Using RL and LLMs
• Abstract summary: We review various AI-based solutions in building network- and device-level cyber deception methods in contested environments.<n>Specifically, we focus on leveraging the fusion of large language models (LLMs) and reinforcement learning(RL) in optimally learning these cyber deception strategies.
• Score: 1.4409807624582138
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Cyber deception assists in increasing the attacker's budget in reconnaissance or any early phases of threat intrusions. In the past, numerous methods of cyber deception have been adopted, such as IP address randomization, the creation of honeypots and honeynets mimicking an actual set of services, and networks deployed within an enterprise or operational technology(OT) network. These types of strategies follow naive approaches of recreating services that are expensive and that need a lot of human intervention. The advent of cloud services and other automations of containerized applications, such as Kubernetes, makes cyber defense easier. Yet, there remains a lot of potential to improve the accuracy of these deception strategies and to make them cost-effective using artificial intelligence (AI)-based solutions by making the deception more dynamic. Hence, in this work, we review various AI-based solutions in building network- and device-level cyber deception methods in contested environments. Specifically, we focus on leveraging the fusion of large language models (LLMs) and reinforcement learning(RL) in optimally learning these cyber deception strategies and validating the efficacy of such strategies in some stealthy attacks against OT systems in the literature.

Related papers

• Hybrid CNN-LSTM Framework for Intelligent Cyber Attack Detection and Prevention in U.S. Critical Digital Infrastructure: A Comparative Machine Learning Evaluation on CSE-CIC-IDS2018 [0.8496907566303933]
  This research suggests a smart cyber-defense system, which utilizes Artificial Intelligence (AI) and Machine Learning (ML) algorithms.<n>The framework proposed combines data preprocessing, feature engineering, real-time traffic monitoring, intelligent threat classification with automated prevention mechanisms.
  arXiv  Detail & Related papers  (2026-06-04T05:14:01Z)
• Surveying the Operational Cybersecurity and Supply Chain Threat Landscape when Developing and Deploying AI Systems [0.08594140167290097]
  This paper serves to raise awareness of the novel cyber threats that are introduced when incorporating AI into a software system.<n>We explore the operational cybersecurity and supply chain risks across the AI lifecycle.<n>By understanding these risks, organizations can better protect AI systems and ensure their reliability and resilience.
  arXiv  Detail & Related papers  (2025-08-27T22:46:23Z)
• Expert-in-the-Loop Systems with Cross-Domain and In-Domain Few-Shot Learning for Software Vulnerability Detection [38.083049237330826]
  This study explores the use of Large Language Models (LLMs) in software vulnerability assessment by simulating the identification of Python code with known Common Weaknessions (CWEs)<n>Our results indicate that while zero-shot prompting performs poorly, few-shot prompting significantly enhances classification performance.<n> challenges such as model reliability, interpretability, and adversarial robustness remain critical areas for future research.
  arXiv  Detail & Related papers  (2025-06-11T18:43:51Z)
• INSIGHT: A Survey of In-Network Systems for Intelligent, High-Efficiency AI and Topology Optimization [43.37351326629751]
  In-network AI is a transformative approach to addressing the escalating demands of Artificial Intelligence (AI) on network infrastructure.<n>This paper provides a comprehensive analysis of optimizing in-network computation for AI.<n>It examines methodologies for mapping AI models onto resource-constrained network devices, addressing challenges like limited memory and computational capabilities.
  arXiv  Detail & Related papers  (2025-05-30T06:47:55Z)
• A Virtual Cybersecurity Department for Securing Digital Twins in Water Distribution Systems [39.58317527488534]
  Digital twins (DTs) help improve real-time monitoring and decision-making in water distribution systems.<n>Their connectivity makes them easy targets for cyberattacks such as scanning, denial-of-service (DoS), and unauthorized access.<n>We present a Virtual Cybersecurity Department (VCD), an affordable and automated framework designed for SMEs.
  arXiv  Detail & Related papers  (2025-04-28T21:14:48Z)
• Multi-Objective Reinforcement Learning for Automated Resilient Cyber Defence [0.0]
  Cyber-attacks pose a security threat to military command and control networks, Intelligence, Surveillance, and Reconnaissance (ISR) systems, and civilian critical national infrastructure.<n>The use of artificial intelligence and autonomous agents in these attacks increases the scale, range, and complexity of this threat and the subsequent disruption they cause.<n> Autonomous Cyber Defence (ACD) agents aim to mitigate this threat by responding at machine speed and at the scale required to address the problem.
  arXiv  Detail & Related papers  (2024-11-26T16:51:52Z)
• Countering Autonomous Cyber Threats [40.00865970939829]
  Foundation Models present dual-use concerns broadly and within the cyber domain specifically. Recent research has shown the potential for these advanced models to inform or independently execute offensive cyberspace operations. This work evaluates several state-of-the-art FMs on their ability to compromise machines in an isolated network and investigates defensive mechanisms to defeat such AI-powered attacks.
  arXiv  Detail & Related papers  (2024-10-23T22:46:44Z)
• AI-Enabled System for Efficient and Effective Cyber Incident Detection and Response in Cloud Environments [0.0]
  The escalating sophistication and volume of cyber threats in cloud environments necessitate a paradigm shift in strategies.<n>This research explores the application of AI and ML and proposes an AI-powered cyber incident response system for cloud environments.<n>The findings highlight the effectiveness of the Random Forest model, achieving an accuracy 90% for the Network Traffic and 96% for the Malware Analysis Dual Model application.
  arXiv  Detail & Related papers  (2024-04-08T15:22:03Z)
• Artificial Intelligence-Based Smart Grid Vulnerabilities and Potential Solutions for Fake-Normal Attacks: A Short Review [0.0]
  Smart grid systems are critical to the power industry, however their sophisticated architectural design and operations expose them to a number of cybersecurity threats. Artificial Intelligence (AI)-based technologies are becoming increasingly popular for detecting cyber assaults in a variety of computer settings. The present AI systems are being exposed and vanquished because of the recent emergence of sophisticated adversarial systems such as Generative Adversarial Networks (GAN)
  arXiv  Detail & Related papers  (2022-02-14T21:41:36Z)
• Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain [58.30296637276011]
  This paper summarizes the latest research on adversarial attacks against security solutions based on machine learning techniques. It is the first to discuss the unique challenges of implementing end-to-end adversarial attacks in the cyber security domain.
  arXiv  Detail & Related papers  (2020-07-05T18:22:40Z)
• Security of Distributed Machine Learning: A Game-Theoretic Approach to Design Secure DSVM [31.480769801354413]
  This work aims to develop secure distributed algorithms to protect the learning from data poisoning and network attacks. We establish a game-theoretic framework to capture the conflicting goals of a learner who uses distributed support vector machines (SVMs) and an attacker who is capable of modifying training data and labels. The numerical results show that distributed SVM is prone to fail in different types of attacks, and their impact has a strong dependence on the network structure and attack capabilities.
  arXiv  Detail & Related papers  (2020-03-08T18:54:17Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.