A Cloudified Dynamic Defense Framework for Cyber Deception as a Service

Current Cyber Deception as a Service (CDaaS) offerings force a trade-off between low-cost, low-fidelity services and expensive, high-fidelity on-premise deployments. To break this impasse, this study proposes DDCA (Dynamic Deception Cloudification Architecture), a novel cloudified defense framework. DDCA leverages a programmable data plane to construct a high-fidelity cloud deception environment with dynamic topology and controllable characteristics, enabling physically static deception resources to exhibit dynamic behaviors, thus confounding protected services and decoys at the network layer. We first built the DDCA attack-defense theoretical model capable of quantifying attacker's cognitive uncertainty relying on partially observable data. Furthermore, we designed a deception orchestration engine based on Deep Reinforcement Learning (DRL) that transforms defensive constraints into executable strategies of DDCA, jointly optimizing the attack surface hopping, topology reconfiguration, and obfuscated characteristic injection. Experiments conducted on a prototype platform demonstrated that the DDCA can significantly increase expected attack costs at an acceptable expense while effectively countering advanced reconnaissance, providing a more economical systematic solution for CDaaS.