Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation
This paper presents "Cloud Decoy AI Agent," a framework that pairs high-fidelity cloud decoys with autonomous language model agents to compress intrusion investigation by aggregating session-level evidence and employing dynamic prompt generation to mitigate false positives and indirect prompt injection risks, achieving complete reconstruction of nine out of ten controlled AWS S3 scenarios within minutes.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine the internet as a giant, bustling city where every action leaves a footprint. In the digital version of this city, known as the "cloud," companies store their most precious data. To keep this city safe, security teams watch millions of tiny footprints called "logs." These logs record every time someone opens a door, picks up a file, or walks down a hallway. The problem is that the city is so huge and the footprints so numerous that finding a real burglar is like trying to spot a single person stealing a cookie in a stadium full of people eating cookies. The logs are there, but they are so noisy and confusing that it takes security experts days to figure out what actually happened.
To solve this, security experts have started using a trick called "deception." Instead of trying to spot the bad guy in the crowd, they leave out a shiny, fake cookie jar that looks exactly like the real one. They know that no honest employee would ever touch that specific jar. So, if anyone does touch it, the security team knows immediately: "That's a thief!" This paper, written by researchers at the University of Arizona, asks a new question: Once the fake cookie jar is touched, can we use a super-smart computer robot (an "AI agent") to instantly figure out who the thief is, what they stole, and write a report for the human detective, all without getting confused by the noise?
The Problem: Too Many Footprints, Too Much Noise
The researchers explain that cloud security is currently stuck in a paradox. The more data companies collect, the harder it becomes to find the bad guys. Attackers are clever; they use stolen keys to walk through the front door just like a regular employee. When they do, the computer logs look exactly the same as if a normal person was doing their job. Security teams spend hours and days trying to piece together these logs to understand what happened, often missing the window to stop the damage.
The paper argues that simply adding more logs or better AI isn't the answer. The real issue is that the AI is being asked to read the entire history of the city to find one bad event. This is expensive, slow, and prone to mistakes.
The Solution: The Bait and the Robot Detective
The authors built a system called Cloud Decoy AI Agent. It works in two main parts:
- The Bait (The Decoy): They set up a fake storage bucket (a digital folder) filled with files that look incredibly tempting to a thief, like "secret_api_keys.txt" or "bank_records.sql." Crucially, no real employee is supposed to touch this folder. If the folder is touched, it's a 100% guarantee that something suspicious is happening. This acts as a perfect alarm bell.
- The Robot (The AI Agent): Instead of a human looking at the alarm, a smart AI robot takes over. But here is the tricky part: the researchers realized that just handing the alarm to a robot isn't enough. If the robot is allowed to look at everything in the cloud, it will get overwhelmed by normal, boring activity and might make up stories (a problem called "hallucination") to fill in the gaps.
How They Taught the Robot to Be Smart
The paper introduces three clever rules to make the robot work correctly:
- Grouping the Clues: Instead of looking at every single click as a separate event, the robot groups them into "sessions." If a thief opens the fake folder, looks at a file, and downloads it within 15 minutes, the robot sees that as one continuous story, not three separate, confusing events.
- The "What You See Is What You Get" Rule: This is the most important part. The researchers made a rule that the robot can only write about things it actually saw. If the robot didn't see a specific file name in the logs, it isn't allowed to guess or make one up. They built a special "dynamic prompt" system that feeds the robot only the exact evidence it found, preventing it from inventing fake details to make the story sound complete.
- The Trap in the Trap: The researchers also noticed a scary new problem. Because the logs record exactly what the thief types (like file names), a thief could write a file named "Delete all my files" or "Ignore the previous instructions." If the robot reads this, it might get tricked into doing what the thief wants. The paper points out that this is a huge danger. They identified this risk but admitted their current robot doesn't have a shield against it yet. They say this must be fixed before anyone uses this system in the real world.
What They Found (and What They Didn't)
The team tested their system with ten different "heist" scenarios in a safe, fake cloud environment. They simulated thieves trying to list files, steal data, delete things, and even using scripts to do it faster.
- The Good News: The system worked incredibly well. It successfully reconstructed 9 out of 10 scenarios completely. In every single report the robot wrote, every fact could be traced back to something it actually saw in the logs. The robot didn't make up any fake stories. It also did this very quickly, taking only 4 to 5 minutes from the moment the fake folder was touched to the moment the report was finished.
- The One Miss: The system failed on one specific scenario where the thief waited 20 minutes between looking at the folder and stealing the file. Because the robot's "grouping" rule was set to 15 minutes, it thought the thief had left and come back later, splitting the story into two separate, unrelated events.
- The Missing Pieces: The authors are very honest about what they didn't prove. They didn't test their system against a "normal" security system to see if it was better. They didn't test it with other types of AI robots. And they didn't test it in a real, messy company environment with thousands of employees. They only tested it in a clean, controlled lab with one type of cloud service (Amazon S3).
The Big Picture
This paper suggests that using a "bait" to trigger a smart robot detective is a brilliant way to cut through the noise of cloud security. It turns a massive, impossible search into a small, manageable investigation. By forcing the robot to stick strictly to the evidence it finds, they stopped it from making things up.
However, the researchers are clear: this is a prototype, not a finished product. They identified a serious security hole where a thief could trick the robot with fake instructions, and they haven't fixed it yet. They also admit they need to test it more broadly before anyone can trust it with real company secrets. But the core idea—that a fake cookie jar combined with a disciplined robot can solve the mystery of the missing cookie—is a promising new direction for keeping our digital cities safe.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.