The rapidly evolving nature of cybersecurity threats necessitates the development of more adaptive and dynamic defence strategies. Traditional methods often fall short against modern attackers' tactics, amplifying the Defender's Dilemma. While malicious actors only need to exploit one vulnerability, defenders must secure all potential entry points. This thesis addresses this challenge by proposing SYNAPSE (Synthetic AI Pot for Security Enhancement), an innovative approach to cybersecurity defence that combines the deceptive nature of honeypots with the adaptive capabilities of AI. The research explores how such dynamic systems can significantly enhance cyber defences, transforming honeypots from passive lures into active participants in cybersecurity. A vital component of this work is the automatic mapping of logs generated by SYNAPSE to the MITRE ATT\&CK framework. By integrating machine learning technologies, SYNAPSE accelerates the identification of attack patterns, offering defenders immediate insights into the strategies employed by attackers.

The Literature Review in Chapter \ref{chap:literature_review} covers foundational concepts surrounding information security, cybersecurity, and honeypot technologies. It also provides an overview of machine learning, generative artificial intelligence and the advancements in large language models (LLMs), which form the backbone of SYNAPSE's AI-driven responses. The literature review also introduces the MITRE ATT\&CK framework, establishing its significance in contextualizing cyber threats and mapping SYNAPSE's logs to adversary tactics.

The Methodology, Chapter \ref{chap:methodology}, details SYNAPSE's design, development, and implementation. The system simulates a Linux OS terminal with critical services like SSH and MySQL servers designed to mimic real-world interactions with attackers. In addition, the SYNAPSE-to-MITRE extension is introduced, which automatically maps the collected logs to the MITRE ATT\&CK framework. This chapter also includes case studies aimed at evaluating SYNAPSE's functioning. Various tests are implemented, including AI vs AI scenarios where the dynamic honeypot interacts with AI-driven attack tools to assess its adaptability and resilience. DENDRITE, a static equivalent of SYNAPSE, is also introduced to enable comparative analysis, highlighting the advantages of integrating AI into cybersecurity defences.

The Results in Chapter \ref{chap:results} highlight the essential findings from three distinct experiments conducted to evaluate SYNAPSE's performance. The first involved real-world attackers, where SYNAPSE's dynamic interaction capabilities allowed for extracting valuable data. This provided insights into global attack patterns and confirmed the system's effectiveness in capturing critical intelligence. The second experiment involved controlled user interactions by comparing SYNAPSE with DENDRITE, its static counterpart. This analysis emphasized the limitations of traditional honeypots and demonstrated SYNAPSE's superior ability to simulate a realistic environment. Finally, the third experiment focused on AI vs AI scenarios and showcased SYNAPSE's adaptability in responding to AI-driven attacks. It also outlined its ability to accurately map these complex adversarial techniques to the MITRE ATT\&CK framework.

This research contributes to the broader field of cybersecurity by showcasing the effectiveness of AI-enhanced honeypots and automated log mapping to MITRE ATT\&CK. Future work could explore integrating more advanced AI models, improving operational speed and accuracy, simulating a more comprehensive set of services, and refining its threat mapping capabilities. This thesis lays the foundation for further exploration into AI-driven defence mechanisms, highlighting the importance of dynamic, adaptable tools in an ever-evolving cyber threat landscape.