AI-Driven Dynamic Cyber Deception for OT/ICS

A portfolio-oriented public edition of an academic prototype that explores how AI-driven intent classification and risk scoring can inform adaptive cyber-deception decisions in an OT/ICS lab.

The project sits at the intersection of AI/Data Science, security analytics, and industrial systems. Its strongest contribution is the data/decision pipeline: translating security telemetry into sessions, adapting features to the X-IIoTID model schema, classifying intent, resolving the targeted asset, scoring risk, and deciding whether deception should escalate.

Important: this repository is intentionally honest about what was and was not validated. The project does not claim that a natural real attack completed the entire chain through automatic high-risk adaptation.

What the system does

flowchart LR
    A[Network traffic] --> B[Suricata]
    B --> C[Wazuh]
    C --> D[Session tracker]
    D --> E[Feature adapter]
    E --> F[Random Forest intent model]
    F --> G[Asset resolver]
    G --> H[Decision engine]
    H --> I[Topology bridge]
    H --> J[Dynamic Conpot controller]

Loading

The intended flow is:

Traffic → Suricata → Wazuh → sessions → feature adaptation → AI intent → asset resolution → risk/decision logic → controlled deception adaptation

Highlights

• Intent classification: Random Forest trained on X-IIoTID.
• Feature adaptation: maps live session telemetry to the model's 51-feature schema while documenting approximations and schema gaps.
• Asset-aware risk: combines predicted intent, model confidence, and OT asset criticality.
• Stateful topology: tracks attacker progression and dormant/active decoy assets.
• Adaptive deception: controlled Conpot switching between BASELINE and ESCALATED profiles.
• Evidence-first design: validation notes explicitly separate natural pipeline behavior from controlled smoke tests.

Repository structure

.
├── src/                    # Core Python pipeline and integration modules
├── config/                 # Example asset map, Compose file, lab Suricata rule
├── docs/                   # Architecture and validation notes
├── models/                 # Model instructions; binary intentionally excluded
├── runtime/                # Local generated state (gitignored)
├── .env.example            # Environment-specific integration settings
├── .gitignore
└── requirements.txt

Quick start

python -m venv .venv
# Windows: .venv\Scripts\activate
# Linux/macOS: source .venv/bin/activate
pip install -r requirements.txt

Place a compatible trained model at models/xiiotid_intent_model.pkl or set MODEL_PATH.

For sessionization:

python src/session_tracker_gap10.py <alerts.jsonl> runtime/sessions_gap10.jsonl

For the main AI/decision pipeline:

python src/pipeline_v2.py

The Wazuh and Conpot integrations are optional and require your own isolated lab configuration. See .env.example.

Model snapshot

The validated delivery reported:

Metric	Value
Model	Random Forest
Features	51
Intent classes	10
Macro F1	0.9481
Accuracy	0.9835
Weighted F1	0.9837

Macro F1 was treated as the primary metric because the classes are imbalanced.

Validation scope

The project delivery validated the model offline, the session-to-intent pipeline, asset/risk decision logic, real telemetry ingestion in the lab, and controlled Conpot profile switching. The natural live sessions observed did not reach ELEVE risk, so a full natural attack → detection → AI → high-risk → automatic adaptation sequence was not demonstrated.

See docs/VALIDATION.md for the precise scope and limitations.

Public-repository changes

This GitHub edition is deliberately cleaner than the internal lab delivery:

• no passwords, tokens, private keys, or credential files;
• no real lab hostnames/IPs or absolute workstation paths;
• no raw alert/session evidence dumps;
• no 271 MB model binary;
• no lab-only traffic generator;
• no private deployment adapter (docker_manager.py);
• no dashboard frontend asset that was not present in the final delivery ZIP.

The source modules retain the architecture and decision logic while environment-specific details are moved to variables/examples.

Limitations

• Live telemetry does not perfectly match the X-IIoTID training schema; some features are approximated or unavailable.
• Default Modbus signatures did not detect every tested reconnaissance pattern; a lab-specific rule was used for controlled detection validation.
• The dashboard's component-health indicators were not direct real-time health checks of every third-party service.
• Automatic silent ESCALATED → BASELINE reversion is not part of the validated architecture. Reversion is an explicit operator action.
• The public repository cannot deploy new decoy containers unless a compatible local docker_manager integration is supplied.

Responsible use

Use only in systems and labs you own or are explicitly authorized to test. The repository is intended for defensive research, education, and portfolio review.

---

Salma Ait Dada
AI & Data Science · Security Analytics · OT/ICS