An Adaptive AI-Based Framework for Real-Time Cyber Threat Detection in Networked Environments

Abstract

In modern networked environments, there is constant, high-volume traffic flow and telemetry is generated, with the frequency of attacks outpaced by update of static detection rules. In this paper, we propose an adaptive AI-based framework for real-time cyber threat detection, which consists of two lightweight, mathematically simple algorithms: Real-Time Feature Aggregation and Scoring (RTFAS) that would store streaming exponentially-weighted feature stats and provide a continuously updated behavioral risk score, and Adaptive Threat Response Classification (ATRC) that would map that score into a calibrated threat verdict, by dynamically adjusting a self-learning decision threshold and produce a graded response action. It is evaluated on a combined network and host telemetry dataset using a static rule based intrusion detection system, a base deep neural network classifier, and an ensemble machine-learning baseline (Random Forest + SVM). The proposed framework attains an accuracy of 98.4%, a precision of 97.9%, a recall of 97.6%, an F1-score of 97.7%, a detection latency of 6.3ms, a false alarm rate of 1.2% and outperforms the other baseline methods in all measured metrics. The results show the potential use of streaming feature aggregation together with an adaptive decision threshold is a practical and low-latency detection pipeline for real-time deployment in networked environments.