AI Deception System · Research SOC

LIVE DECEPTION FABRIC

Attackers see bait.
You see intent.

Run a controlled scenario through the same persisted inference and review path used by imported evidence.

DETERMINISTIC TEST PROFILE90 failed logins · 2 commands · 45-second session · documentation IP 198.51.100.20

Events analysed0Persisted telemetry

ML anomalies0Isolation Forest

Critical threats0Score ≥ 80

Canary triggers0Explicit deception

Average threat0Hybrid score / 100

Unique sources0Observed addresses

PRIORITY QUEUE

Highest-risk evidence

Run a scenario or import evidence to begin.

SESSION DISTRIBUTION

Risk posture

Explainable model

Hybrid detection

Behavioural outliers are combined with transparent security rules so high-confidence deception signals remain understandable.

PERSISTED EVIDENCE STREAM

Threat feed

Inspect, classify and annotate every event stored in this private laboratory session.

DATASET INTAKE

Analyse a bounded JSON evidence set

Download sample

Time	Source	Type	Severity	Score	ML	Status

No events recorded in this session.

DECEPTION LAYER

Canary laboratory

Create benign decoy records and turn controlled access into a high-confidence security signal.

REGISTER DECOY

Create a canary artifact

Decoy name

The laboratory stores an identifier and trigger count; it does not create usable credentials.

ACTIVE DECOYS

Canary inventory

No canaries registered.

AI / ML ENGINE

Explainable anomaly scoring

The model is one signal—not a magic label. Every assessment retains interpretable reasons.

01

Behaviour features

Command volume, session duration, login failures, suspicious activity and canary interaction.

02

Isolation Forest

Unsupervised inference estimates whether a session departs from the retained synthetic benign baseline.

03

Threat fusion

Model output is fused with explicit rules so obvious attack patterns cannot be obscured.

VERIFIED EXECUTION PATH

One evidence lifecycle

Controlled scenario
or dataset→Normalised event→Isolation Forest
+ rules→DynamoDB
evidence store→HTTP API→Analyst console

Turn intrusion
into intelligence.

Threat overview

Attackers see bait.
You see intent.

Highest-risk evidence

Risk posture

Threat feed

Analyse a bounded JSON evidence set

Canary laboratory

Create a canary artifact

Canary inventory

Explainable anomaly scoring

Behaviour features

Isolation Forest

Threat fusion

One evidence lifecycle

Turn intrusioninto intelligence.

Attackers see bait.You see intent.

Highest-risk evidence

Risk posture

Threat feed

Analyse a bounded JSON evidence set

Canary laboratory

Create a canary artifact

Canary inventory

Explainable anomaly scoring

Behaviour features

Isolation Forest

Threat fusion

One evidence lifecycle

Turn intrusion
into intelligence.

Attackers see bait.
You see intent.