AI-DRIVEN SMART DECEPTION FRAMEWORK FOR ENHANCING INFORMATION TECHNOLOGY SECURITY USING ADAPTIVE HONEYPOT AND BEHAVIOURAL ANALYTICS

The increasing frequency and sophistication of cyberattacks have exposed critical weaknesses in conventional information technology (IT) security architectures that rely primarily on static and signature-based intrusion detection systems. To address this, the study aims to develop an AI-driven smart deception framework for enhancing information technology security. The testbed IT network considered is Galaxy Backbone public cloud. The methodology used is characterization of the testbed, data collection and analysis, design of smart honeypot for real-time deception and adaptive response to threat using hybrid model of Long Short-Term Memory (LSTM) and Logistic Regression (LR), behavioural analytical model, smart honeypot, system integration on the testbed, implementation, testing, evaluation, and validation. The LSTM layer captured sequential and temporal dependencies in traffic behaviour, while the LR classifier transformed learned features into binary threat probabilities. The hybrid system achieved an overall accuracy of 0.98, with precision and recall of 0.95, demonstrating superior classification success. The behavioural analysis yielded 92% anomaly detection, 85% behavioural accuracy, 84% threat prediction, and 94% pattern recognition performance. The results revealed that 87% of attackers interacted with decoy systems for an average of 23 minutes, generating 94% actionable threat intelligence. The system integration and testing effectively detected 12 anomalous behavioural patterns and prevented 7 potential intrusion incidents, confirming its ability to correctly classify use behaviour and then divert the threat to decoy facility. The study concludes that AI-based deception can serve as a powerful layer of intelligent defence in modern IT infrastructures. It is recommended that Galaxy Backbone Limited and other critical service providers adopt this smart honeypot framework to enhance network resilience, threat visibility, and real-time defence capability.