Search papers, labs, and topics across Lattice.
This paper introduces the Cloud Decoy AI Agent, a novel framework that integrates a high-fidelity cloud decoy with an autonomous language model to streamline the investigation of suspicious cloud activity. By focusing on session-level analysis rather than individual events, the framework effectively reduces the complexity of intrusion analysis in environments where attackers leverage legitimate identities and cloud APIs. Evaluation across ten controlled AWS S3 scenarios demonstrated that the system successfully reconstructed nine incidents with no untraceable assertions, achieving a latency of four to five minutes, although the authors acknowledge limitations in their prototype's current implementation.
By transforming session-level data into actionable insights, this framework could revolutionize how analysts respond to cloud intrusions, making investigations faster and more reliable.
Cloud telemetry arrives at a scale that, paradoxically, makes intrusion understanding harder rather than easier. Attackers operate through legitimate identity, federated session tokens, and cloud native APIs indistinguishable from routine administration, and analysts spend an incident reconstructing context the logs already contain. We present Cloud Decoy AI Agent, a framework pairing a high fidelity cloud decoy with an autonomous language model agent that compresses the path from suspicious activity to an analyst ready report. Connecting a decoy to an agent is not a wiring exercise. The unit of investigation is the session rather than the event, and the session key is obscured by the identity layering federated credentials introduce. The agent's evidence horizon must be bounded, since an agent free to query full control plane history inherits the cost and false positive profile deception was meant to remove. And cloud telemetry is partly adversary authored, since object keys and user agent strings are attacker chosen values providers record verbatim, which makes any log to prompt path an indirect prompt injection channel that a decoy widens rather than narrows. We address the first two with a session aggregation operator over a pivot tuple drawn only from provider derived fields, and with dynamic prompt generation, a two stage prompt assembly enforcing a grounding invariant by carrying only fields the agent observed. We identify the third as an unaddressed exposure in this class of system, specify the mitigation it requires, and note our prototype does not implement it. Across ten controlled AWS S3 scenarios, nine were reconstructed completely, no report contained an assertion untraceable to an observed artifact, and latency was four to five minutes. We also state what this evaluation does not establish and name the comparisons that would settle it.
