The Attacker Cognitive Loop: Closing the Information Asymmetry Through Guided Cyber Deception — An Interpretable, Rule-Based Engine with Reproducible Experiments

This preprint presents the Attacker Cognitive Loop (ACL), an interpretable rule-based engine for guided active defense that actively reverses the information asymmetry between attacker and defender. Instead of blocking attacker actions, ACL guides attackers through lightweight ephemeral decoys, forcing them to reveal their tactics, techniques, and procedures (TTPs) and intent earlier than intended. The engine closes the loop between observation, state estimation, behavior prediction, and utility-driven engagement selection, with a sharpness-driven strategy that switches between containment, intelligence collection, and active engagement. We formulate the core research question of how AI, shared tooling, and individual experience jointly shape attacker action distributions, and whether defenders can actively reshape them through observation, deception, and guidance. This work states ten open research questions (Q1-Q10) with evidence ratings and a validation plan. The engine is fully implemented as a modular, unit-tested extension of the open-source ASSCOR platform, with every component mapped to a public repository path. We provide the complete formal specification of scoring, normalization, sharpness, and utility functions, a reproducible four-round closed-loop trace with exact numerical values, and a sensitivity analysis of the hand-tuned weights. This is not a paper-only design: all code, experimental data, and lab configurations are included in this upload and publicly available. This work does not claim defensive efficacy; it offers the community a transparent, modular testbed for validating or falsifying the stated research questions. Keywords: active defense, cyber deception, attacker modeling, honeypot, decision sharpness, moving target defense, interpretable AI, reproducible research