Aug 2026· Al-Noor Journal of Engineering Management and Computer Science· pp. 509-517· 0 citations· 10 references
TL;DR
This paper presents a data-driven analysis of network attack detection and reduction using machine learning, deep learning, and an Autonomous Defense Agent (ADA) for real-time threat detection and response, and provides an ADA design to validate real benchmark datasets.
Abstract
AI-driven cyberattacks represent major challenges to detect by classic security frameworks, which makes it important to employ intelligent and autonomous mechanisms. In this paper, we present a data-driven analysis of network attack detection and reduction using machine learning, deep learning, and an Autonomous Defense Agent (ADA) for real-time threat detection and response. Experiments are done on two benchmark datasets CIC-IoT 2023 and UNSW-NB15 datasets, representing network intrusion scenarios. We addressed the imbalance in the dataset CIC-IoT 2023 with a 1:41 benign-to-attack skewed ratio by applying the Synthetic Minority Over-sampling Technique (SMOTE) to the training set. For classification progress, we used four classical ML classifiers (Decision Tree, Random Forest, XGBoost, and KNN), and also an LSTM model. Furthermore, we designed an Autonomous Defense Agent (ADA) for real-time intrusion detection. The highest F1 achieved for Random Forest is 99.39% on CIC-IoT 2023 and 88.67% on UNSW-NB15. For XGBoost, the same accuracy was achieved with 12 times faster training speed. This makes it the preferred ADA backbone. LSTM outperforms on structured IoT traffic with F1=98.82%, but on the other hand, fails on heterogeneous traffic with F1=43.29%. This shows how data temporal characteristics affect model selection. The ADA achieves 99.94% precision on CIC-IoT 2023 with sub-1ms average response latency. The results provide a principled model selection criterion that prefers the classical ML methods for heterogeneous traffic and LSTM for temporally structured IoT traffic, and also provides an ADA design to validate real benchmark datasets.
An intelligent DDoS detection and mitigation framework that combines classical Machine Learning (ML) classifiers with Deep Learning (DL) architectures to achieve high-fidelity, low-latency attack identification across heterogeneous network topologies is presented.
S. Singh, Alok Kumar· International Journal of Com...· 0 citations
LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies, which shows its capacity in learning long-lasting dependencies.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
Advanced persistent threats, zero-day exploits, encrypted command-and-control traffic, and botnet campaigns continue to reduce the reliability of conventional intrusion detection systems because static detectors provide limited transparency and weak adaptation under traffic drift. This paper presents an explainable and adaptive machine learning framework that integrates a LightGBM threat detector, SHAP-based decision explanations, density-aware concept drift detection, active incremental updating, and a contextual bandit defense policy. LightGBM is adopted because its leaf-wise gradient boosting structure provides high discrimination for heterogeneous flow features while maintaining low inference latency and native feature-importance support. The framework is evaluated on CIC-IDS2017, UNSW-NB15, and ToN_IoT using stratified train-validation-test splits, leakage prevention, five-run validation, and a 48-hour Kafka-based streaming simulation. The proposed model achieved 99.1% accuracy, 98.7% F1-score, 98.4% recall, and a 0.007 false alarm rate. During streaming evaluation, 14 adaptive model updates reduced mean detection latency from 27.4 s to 11.2 s, while SHAP explanations based on DNS entropy, JA3 rarity, packet interval, and flow-duration evidence reduced analyst triage time by 23%. Comparative results show that the proposed explainable adaptive pipeline improves detection reliability, reduces false alarms, and supports auditable mitigation decisions better than static and black-box IDS baselines.
P. A. Prakash, Salath Joseph A, A. M et al.· 2026 7th International Confe...· 0 citations
Cyber threats are becoming so complicated and rampant in today's highly connected digital world that there is a tremendous need for intelligent, adaptive IDS. Detecting and responding against network intrusions in real-time is the aim of the present work, which proposes a real-time Network Intrusion Detection and Automated Response Framework developed by Multi-Agent Deep Q-Network (MADQN). The proposed design uses the UNSW-NB15 network traffic set and discriminates and classifies attacks by using supervised machine learning models including Logistic Regression model, Decision Tree model, Random Forest model and the Neural Network classifiers. To augment the automation of the response, a reinforcement learning layer of three cooperative agents: Detection Agent, Blocking Agent and Isolation Agent is introduced based on Deep Q-Networks (DQNs). They learn the optimal mitigations actions they should take on a network state represented in 221 dimensions, and through the experience replay and epsilon-greedy exploration with the reinforcement learning, the agents learn. The results of the experiments demonstrate excellent response detection and 99.38% classification accuracy for the Random Forest model; for the intelligent response selection, the MADQN framework has a good neutralization rate of 93.94%. The architecture designed in the Flask can be fully integrated to the user authentication, attack prediction, attack response management and historical monitoring architecture. Overall, the proposed framework presents a powerful cybersecurity solution that integrates ML and MARL, enabling more secure and resilient networks.
S. Banu, D. Manogna, Farooq Sunar Mahammad et al.· 2026 International Conferenc...· 0 citations
Large-scale DDoS attacks remain a serious threat to today's networked systems, which aim to make services unavailable by sending a massive amount of traffic. The traditional detection methods are mostly about attack categorization and are not that context-aware or actionable in providing support to security analysts. We propose SentinelsGuard AI, a self-learning DDoS classification and mitigation system that is built from a combination of machine learning, retrieval-augmented knowledge, and LLM-based reasoning in one platform. The proposed system is realized as a Flask-based web application, which processes the network flow statistics data, extracted from incoming traffic, and transforms the data to generate representative features of the network flows, before detecting the attacks using the XGBoost classifier. After classification, the framework accesses domain-specific attack intelligence from a structured Retrieval-Augmented Generation (RAG) knowledge base with profiles of multiple categories of DDoS attacks. This contextual information is used with LLM-enabled reasoning to derive comprehensible security explanations, determine the severity of the attack, and suggest the firewall mitigation rules that can be applied. The framework stores analysis data in a SQLite database for operational monitoring, and displays security events in an interactive dashboard that includes traffic visualization, attack logs, and threat summaries. The architecture proposed brings statistical learning together with contextual knowledge of cybersecurity and attempts to bridge the gap between automatic attack detection and explainable incident response. It integrates all the key features of a classification-based network security decision support platform into a single stream, enabling a classification-based approach to network security to become more interpretable and usable in reality: persistent logging, visualization, knowledge retrieval, reasoning, and system recommendation of mitigations.
K. V. Sai Phani, P. Karthik, Farooq Sunar Mahammad et al.· 2026 International Conferenc...· 0 citations
A multi-layered intelligent detection system that unites supervised learning, unsupervised anomaly analysis, and ensemble decision strategies to identify network intrusions, malicious software activity, and stealthy advanced persistent threats in near real time is introduced.
Ameen Pasha.A· International Scientific Jou...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
