Tri-Level Network Attack Risk Stratification Using IDS-Contextual Ensemble Learning

Explainable AI-Based Cyber Threat Detection Framework Using LSTM and Autoencoder for Intelligent Network Security

The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.

Explainable AI and Machine Learning Framework for Cyber Threat Detection and Adaptive Defense Systems

Advanced persistent threats, zero-day exploits, encrypted command-and-control traffic, and botnet campaigns continue to reduce the reliability of conventional intrusion detection systems because static detectors provide limited transparency and weak adaptation under traffic drift. This paper presents an explainable and adaptive machine learning framework that integrates a LightGBM threat detector, SHAP-based decision explanations, density-aware concept drift detection, active incremental updating, and a contextual bandit defense policy. LightGBM is adopted because its leaf-wise gradient boosting structure provides high discrimination for heterogeneous flow features while maintaining low inference latency and native feature-importance support. The framework is evaluated on CIC-IDS2017, UNSW-NB15, and ToN_IoT using stratified train-validation-test splits, leakage prevention, five-run validation, and a 48-hour Kafka-based streaming simulation. The proposed model achieved 99.1% accuracy, 98.7% F1-score, 98.4% recall, and a 0.007 false alarm rate. During streaming evaluation, 14 adaptive model updates reduced mean detection latency from 27.4 s to 11.2 s, while SHAP explanations based on DNS entropy, JA3 rarity, packet interval, and flow-duration evidence reduced analyst triage time by 23%. Comparative results show that the proposed explainable adaptive pipeline improves detection reliability, reduces false alarms, and supports auditable mitigation decisions better than static and black-box IDS baselines.

Multi-Class Network Intrusion Detection: Machine and Deep Learning Benchmark with Live Stream Deployment

Predicting Advanced Persistent Threats using Cyber Threat Intelligence and Machine Learning Techniques

APTs can be very advanced, able to hide within an organization for years, potentially compromising sensitive data and information. Old-fashioned signature-driven security tools don't keep up with the latest and most advanced attacks, and thus require proactive and intel-driven threats detection products. This research aims to design an early prediction and detection system of Advanced Persistent Threat activities with a machine learning system that works on Cyber Threat Intelligence. The architecture pulls together any and all threat intelligence gathered from network traffic logs, security alerts and external sources including Indicators of Compromise that include suspicious IP addresses, malicious website addresses, and other unusual communications. After data preprocessing and feature engineering, machine learning models such as Random Forest, Support Vector Machine, and Gradient Boosting are employed to learn the harmful user actions and foresee potentially high-risk actions. This suggested methodology is tested using the CICIDS2017 and UNSW-NB15 benchmark datasets of cyber security. It was observed from the experimental results that the best results has been obtained by Random Forest classifier with the highest accuracy as 97.8% after the differentiation of the legitimate and harmful activity. The results show that the integration of Cyber Threat Intelligence with machine learning has a significant impact on early threat detection, reduces the number of false-positive alerts and strengthens cyber security efforts to prevent Advanced Persistent Threat attacks.

From Signature to Attention: Transformer-Powered Intrusion Detection Systems for Cybersecurity

Experimental results demonstrate that the proposed model achieves high detection accuracy, strong discriminative capability, and low false alarm rates across both datasets, confirming its effectiveness and scalability for next-generation cybersecurity applications.

MLBRS: A Multi-Layer Behavioural Risk Scoring Framework for Insider Threat Detection

: Insider threats remain difficult to detect because malicious actions often resemble legitimate user behaviour and may evolve gradually over time. This paper presents MLBRS, a multi-layer behavioural risk scoring framework that combines rule-based scoring, statistical deviation analysis, and Isolation Forest-based anomaly detection to generate continuous employee-level risk scores. The framework integrates behavioural indicators, personalised deviation modelling, and multivariate anomaly detection to identify both abrupt and gradual behavioural changes. Due to the limited availability of publicly accessible datasets containing database-query-level insider threat activity, a synthetic dataset was constructed to simulate organisational behaviour with temporal consistency, multiple employee roles, and diverse attack scenarios. Existing insider-threat datasets primarily capture system-level activity and do not adequately represent database interactions. Experimental evaluation demonstrates consistent detection performance, achieving an ROC-AUC of 0.978 and an F1-score of 0.88 on the synthetic dataset. Additional cross-dataset evaluation using CERT-derived behavioural traces shows reduced but stable performance under less aligned behavioural conditions. The results indicate that MLBRS provides an interpretable and scalable approach for behavioural insider threat detection across heterogeneous activity patterns.