CICI: TCR: Enabling Next-Generation Security Operations Center with A LLM-Powered Adaptive Cyber Deceptive Framework

Scientific cyberinfrastructure enables discoveries that depend on high-performance computing, research portals, application programming interfaces, cloud platforms, and large-scale data collaborations. These environments are increasingly targeted by adversaries, and Security Operations Centers must detect, understand, and respond to threats while supporting open and collaborative science. Cyber deception provides a proactive defense by using decoys, deceptive data, and honeypots to mislead attackers and collect intelligence, but current approaches are difficult to adapt across dynamic and heterogeneous scientific computing environments. This project develops a large language model-powered adaptive cyber deception framework for cyberinfrastructure Security Operations Centers. The framework supports realistic deceptive interactions, self-learning deception environments, and automated threat intelligence. It generates context-aware responses during controlled attacker engagement, adjusts decoys and honeypots based on observed adversary behavior, and translates deception-generated evidence into actionable intelligence for security analysts and automated response systems. The research integrates advances in cybersecurity, machine learning, and computer systems to transition adaptive deception methods into operational cyberinfrastructure defense. The system is deployed and evaluated with the National Center for Supercomputing Applications to assess its effectiveness in protecting scientific research infrastructure. Project results are shared through publications, open-source tools, and new undergraduate and graduate course modules. The work strengthens the resilience of scientific cyberinfrastructure, reduces the workload of security analysts, and helps prepare the next generation of cybersecurity professionals. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.