A Theoretical Framework for Autonomous Cyber Deception as a Defensive Strategy for Nigerian Critical Infrastructure

Cyber deception technologies including honeypots, honeytokens, and automated deception environments offer asymmetric advantages to defenders by imposing costs on attackers and generating threat intelligence, and developing an original theoretical framework for their application in Nigerian critical infrastructure contexts fills an important gap between deception theory and practical CNI security. This study developed an original Autonomous Cyber Deception Framework for Nigerian Critical Infrastructure Protection, drawing on deception theory, game theory, and empirical analysis of Nigerian infrastructure threat environments. A multi-phase framework development methodology was employed: systematic review of cyber deception literature (56 publications from 2019 to 2024), threat environment analysis through red team exercises and threat intelligence review at five infrastructure organisations with formal agreements, game-theoretic modelling of attacker-defender deception dynamics, and expert validation. Game-theoretic analysis using a Stackelberg deception game model confirmed that automated deception provides positive expected value when attacker sophistication is low to moderate, covering the majority of Nigerian infrastructure threats. The empirical threat environment analysis identified that most Nigerian infrastructure attacks are opportunistic rather than targeted, making broad deception deployment cost-effective. The original ACD-Nigeria Framework specifies deception deployment architectures for each infrastructure sector, attacker profiling integration for adaptive deception, automated threat intelligence extraction from deception interactions, and legal and ethical boundaries for deception under Nigerian law. Expert review by 18 cyber deception and CNI security specialists confirmed the framework's theoretical and operational originality.

Keywords: cyber deception, honeypot, critical infrastructure, Nigeria, defensive cybersecurity