ForensicGuard: An Autonomous Deception-Based EDR Platform with Time-Bound Cryptographic Authorisation and Machine-Learning Threat Classification

Modern cyberattacks such as ransomware, credential theft, and lateral movement frequently bypass traditional security solutions by abusing legitimate administrative tools and executing anti-forensic techniques. Existing Endpoint Detection and Response (EDR) systems often rely on delayed human intervention, allowing attackers sufficient time to destroy critical evidence and establish persistence. This paper presents ForensicGuard, an autonomous deception-based EDR framework that combines cryptographically authorized honeypots, machine learning-based anomaly detection, adaptive threat scoring, and automated forensic acquisition. The system utilizes HMAC-SHA256 time-bound authorization tokens to distinguish legitimate administrative activity from malicious actions. Unauthorized access to deceptive resources immediately triggers forensic memory capture, endpoint isolation, and evidence preservation. Experimental evaluation demonstrates rapid response times below 100 milliseconds and a detection accuracy of 97.4%. The proposed framework enhances endpoint security while minimizing false positives and preserving volatile forensic evidence.