🤖 AI Summary
This work addresses the challenge of reconstructing adversarial attack contexts in cloud environments, where attackers often leverage legitimate identities and native APIs to operate stealthily, rendering vast telemetry data ineffective for forensic analysis. The authors propose a high-fidelity cloud deception framework synergized with an autonomous large language model (LLM) agent. Their approach introduces a novel session aggregation operator based on provider-specific identifier fields and a two-stage dynamic prompt generation mechanism. This ensures that all inference remains strictly grounded in observed evidence while mitigating indirect injection risks inherent in log-driven prompting. Evaluated across ten controlled AWS S3 attack scenarios, the system successfully reconstructed nine complete attack chains, with every reported assertion traceable to original artifacts and an average response latency of only 4–5 minutes.
📝 Abstract
Cloud telemetry arrives at a scale that, paradoxically, makes intrusion understanding harder rather than easier. Attackers operate through legitimate identity, federated session tokens, and cloud native APIs indistinguishable from routine administration, and analysts spend an incident reconstructing context the logs already contain. We present Cloud Decoy AI Agent, a framework pairing a high fidelity cloud decoy with an autonomous language model agent that compresses the path from suspicious activity to an analyst ready report. Connecting a decoy to an agent is not a wiring exercise. The unit of investigation is the session rather than the event, and the session key is obscured by the identity layering federated credentials introduce. The agent's evidence horizon must be bounded, since an agent free to query full control plane history inherits the cost and false positive profile deception was meant to remove. And cloud telemetry is partly adversary authored, since object keys and user agent strings are attacker chosen values providers record verbatim, which makes any log to prompt path an indirect prompt injection channel that a decoy widens rather than narrows. We address the first two with a session aggregation operator over a pivot tuple drawn only from provider derived fields, and with dynamic prompt generation, a two stage prompt assembly enforcing a grounding invariant by carrying only fields the agent observed. We identify the third as an unaddressed exposure in this class of system, specify the mitigation it requires, and note our prototype does not implement it. Across ten controlled AWS S3 scenarios, nine were reconstructed completely, no report contained an assertion untraceable to an observed artifact, and latency was four to five minutes. We also state what this evaluation does not establish and name the comparisons that would settle it.