Design of an intelligent security system for cyber-attack detection in petrochemical SCADA networks based on a hybrid artificial neural network and Krill-Herd algorithm.

Transformer-based Network Anomaly Detection System for Intelligent Cyber Security Monitoring

As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.

Advanced security learning model for predicting network threats with intelligent approaches

An Intelligent Cyber Threat Detection Framework Using a Hybrid Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) Machine Learning Mode

The attack surface for contemporary cyber threats has greatly increased due to the growing reliance on networked digital systems and internet-driven services. Conventional security solutions that rely on static signatures and predetermined rules are no longer adequate as cyberattacks become more sophisticated and adaptable. Due to these conventional methods' inability to detect new and zero-day threats, network infrastructures are more vulnerable and detection is delayed. This paper offers an intelligent cyber threat detection framework based on a hybrid deep learning architecture that combines Long Short-Term Memory (LSTM) networks with Convolutional Neural Networks (CNN) in order to get around these restrictions. The suggested system does away with the requirement for human feature engineering by using the CNN module to automatically learn and extract significant spatial patterns from network traffic features. The detection of intricate and dynamic attack patterns is therefore made possible by using the LSTM module to represent the temporal linkages and sequential behaviors found in network traffic flows. Widely used intrusion detection datasets are used to verify the efficacy of the suggested model. Standard criteria, such as accuracy, precision, recall, F1-score, and false positive rate, are used to evaluate performance. According to experimental results, the hybrid CNN–LSTM architecture regularly outperforms both individual deep learning models and traditional machine learning techniques in terms of detection performance. The proposed approach demonstrates strong generalization capability and is well suited for real-time deployment in dynamic cybersecurity environments.

Cyber-Physical Attack Detection in Water Distribution Systems Using a Hybrid Ensemble of XGBoost, Isolation Forest, and LSTM Autoencoder on the BATADAL Dataset

Water distribution systems (WDSs) are critical public infrastructures increasingly controlled through cyber-physical layers, making them attractive targets for malicious intrusions. Real-time detection is difficult: confirmed attack data is scarce, sensor readings co-vary across dozens of channels, and well-crafted intrusions are deliberately kept within plausible operating ranges. This paper proposes a three-model hybrid ensemble that combines a supervised XGBoost classifier, an unsupervised Isolation Forest with principal component analysis (PCA) dimensionality reduction, and an unsupervised LSTM Autoencoder trained on 24-hour sliding windows of sensor sequences. All models are evaluated on the BATtle of the Attack Detection Algorithms (BATADAL) training dataset, which contains 4,177 hourly observations from a simulated SCADA-monitored C-Town network spanning July–December 2016, with 219 confirmed attack hours (5.2%) across five distinct attack campaigns. The weighted ensemble (XGBoost 40%, LSTM Autoencoder 50%, Isolation Forest 10%) achieves an F1-score of 0.9336, ROC-AUC of 0.9967, and an average precision of 0.9390, detecting 211 of 219 attack hours with only 22 false positives and a false positive rate of 0.56%. Time-to-detection analysis across all five attack windows confirms that the ensemble provides rapid and reliable detection, identifying four of five attack campaigns within one hour of onset. Results demonstrate that combining complementary detection paradigms substantially outperforms any single-model approach on this benchmark.

A Machine Learning-Based Intrusion Detection Framework for Enhanced Network Security

This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models, and discusses critical challenges affecting the deployment of ML-based IDS.

Artificial Intelligence based Intrusion Detection System