Dynamic cyber deception for the defense of cyber-physical systems

Cyber-Physical Systems (CPS) underpin safety- and mission-critical services across industrial control, smart buildings, connected healthcare, intelligent transportation, and large-scale IoT ecosystems. Their increasing integration with cloud infrastructures and heterogeneous digital components has expanded the attack surface, enabling adversaries to produce physical impact through cyber operations. In such environments, perimeter-centric and reactive security models are insufficient against stealthy, adaptive attackers who operate under partial observability, refine their understanding of the defended system, and exploit legitimate communication channels. This dissertation advances dynamic cyber deception as a principled paradigm for proactive CPS defense. Unlike static deception mechanisms or purely detection-driven approaches, dynamic deception continuously reshapes the attacker’s perceived environment, including exposed services, digital identities, decoy assets, and interaction surfaces, to manipulate adversarial decision-making, increase uncertainty, and impose strategic friction throughout the attack lifecycle. Effective deception in heterogeneous CPS must be evidence-driven, programmable by design, and explicitly governed: adaptations must be triggered by reliable security evidence, implemented through repeatable and policy-constrained mechanisms, and operated within legal and regulatory boundaries. To operationalize these principles, the dissertation introduces Strategic Dynamic Cyber Deception (SDCD). This framework integrates AI-based anomaly detection over multivariate telemetry, Infrastructure-as-Code mechanisms for auditable and policy-bounded reconfiguration, and virtualized testbeds for reproducible experimentation and deployment validation. It also provides a legal and regulatory analysis of active deception, identifying constraints, gray areas, and governance requirements for compliant deployment. The contributions are fourfold: the dissertation formalizes dynamic deception in CPS as an evidence-conditioned, automation-enabled control problem; designs and implements a programmable orchestration architecture for safe and repeatable deception reconfiguration; evaluates feasibility and operational trade-offs on realistic datasets and testbeds; and embeds governance considerations into deception-system design. Overall, this work defines and evaluates an adaptive, governance-aware approach to cyber deception for modern CPS.