Cybersecurity Threats Detection in Intelligent

Networks using Predictive Analytics Approaches

Shomili Duary Pratyusha Choudhury Sushruta Mishra
Kalinga Institute of Industrial Kalinga Institute of Industrial Kalinga Institute of Industrial
Technology, India [email protected] Technology, India Technology, India
[email protected] [email protected]
Vandana Sharma, SMIEEE
Department of Computational Sciences, Deepak Dasaratha Rao Adedapo Paul Aderemi
CHRIST (Deemed to be University), Independent Researcher School of Creative Technologies
Delhi NCR, India Consultant, Infosys, USA University of Bolton, United Kingdom
[email protected] [email protected] [email protected]

Abstract— The modern scenario of network vulnerabilities evolving strategies of hackers make it difficult to identify
necessitates the adoption of sophisticated detection and every possible threat to a corporation. Because unknown
mitigation strategies. Predictive analytics is surfaced to be a risks can cause significant harm if left unnoticed, it is
powerful tool in the fight against cybercrime, offering imperative that we employ cutting-edge solutions like
unparalleled capabilities for automating tasks, analyzing vast artificial intelligence (AI) to successfully identify and
amounts of data, and identifying complex patterns that might prevent them. It has the potential to be resource-intensive
elude human analysts. This paper presents a comprehensive and impractical. Cybercriminals may potentially employ AI
overview of how AI is transforming the field of cybersecurity.
to enhance their attacks. VPNs is a sector that gains from
Machine intelligence can bring revolution to cybersecurity by
analytics since predictive intelligence enables them to
providing advanced defense capabilities. Addressing ethical
concerns, ensuring model explainability, and fostering
defend users against AI-posed online dangers.
collaboration between researchers and developers are crucial The practice of securing system nodes, systems, and data
for maximizing the positive impact of AI in this critical from damage, loss, illegal access, and other cyber threats is
domain. essentially known as cybersecurity. The increasing reliance
on digital technologies in all aspects of our lives has led to
Keywords— AI (Artificial Intelligence), cyber security, cyber the rise in importance and activity of the cybersecurity area.
threats, threat detection Cyber-threat environment, one of the variable factors of
cybersecurity, has a threat landscape that is ever-changing as
a result of different actors using sophisticated ways to
I. INTRODUCTION exploit vulnerabilities for espionage, disruption, or financial
Artificial Intelligence or AI involves simulation or gain. These actors include hackers, cyber criminals, nation-
approximation of human intelligence in machines. The states, and hacktivists. Networking privacy, nodes
ability for artificial intelligence to reason and act in a way authenticity, software privacy, information privacy, IAM etc
that maximizes the likelihood of reaching a given objective are some of the key-elements of cybersecurity. Some typical
is the ideal feature. It is being employed in a variety of cyber hazards such as malware which refers to malicious
industries today, including healthcare and finance. These software, such as viruses are intended to damage or exploit
days, AI is widely applied in many other different contexts computers, phishing which involves the act of assaulting or
and to differing degrees of complexity. Popular AI deceiving people into divulging private information,
applications include recommendation algorithms that make including passwords or bank account information,
suggestions about what you would like to do next and distributed denial of service (DDoS) that is the act of
chatbots that show up on websites or as smart speakers like flooding a system or network with so much traffic that it
Alexa or Siri. Machine learning with data analytics have becomes unusable for users, Man-in-the-Middle (MitM) etc
become very relevant for prevention against cybersecurity diminishes the moral of cybersecurity. The advancement of
threats, they can process huge quantity of information to cybersecurity depends upon artificial intelligence (AI),
detect risks like phishing and malware. To avoid detection, which provides cutting-edge capabilities to combat
cybercriminals might alter virus code, nevertheless. Because sophisticated threats, consisting of anomaly detection in
machine learning can use information from previously which AI examines large datasets to determine typical
identified malware to identify new varieties, it is perfect for behavior and identify anomalies. Behavioral analysis, AI-
anti-malware defense. This is effective even when malicious powered antivirus which uses machine learning to detect and
code is nested inside benign code. Tools for network prevent malicious files based on their behavior rather than
monitoring with AI capabilities can monitor user activity, just their known signatures, automation, user verification,
spot irregularities, and take appropriate action. The ever- biometric authentication, NLP etc helps in collaborating
with cybersecurity in order to enhance its technology will help to detect and diverge into various levels
functionalities. Although artificial intelligence (AI) can of networks risks as they develop which offers us excellent
greatly improve cybersecurity, it is important to remember intrusion and detection capabilities, detects false positives,
that AI is not a panacea. To effectively protect systems and and uses predictive analytics to increase the security of
data, a holistic cybersecurity strategy combines AI information on the internet. Expert systems and a broad
technologies, human knowledge, and other protection variety of neural networks, including both ANNs and DNNs,
measures. are still being released. This study [3] proposed by B.
Thuraisingham explores the importance of cybersecurity and
The main contribution of the paper are as follows: artificial intelligence in social media. The study examined
⚫ Highlights the immense potential of artificial intelligence several techniques of machine learning for social media
to transform cybersecurity through pattern recognition, platforms. Sentiment analysis techniques can detect user
automation, and analyzing massive datasets. opinions and identify the spread of hazardous diseases or
human trafficking activities. Machine learning also enables
⚫ In this paper we proposed a model in the form of a the detection of false information and malicious software on
flowchart that presents a thorough approach to social platforms. The paper even looked at the security and
vulnerability evaluation and cybersecurity threat privacy challenges, including access control methods and
identification that incorporates both conventional and privacy-aware systems tailored for social media. Lastly, it
historical security data sources. discussed various ways in which AI and cybersecurity can
⚫ The field of AI cybersecurity is constantly evolving. be integrated to tackle threats to social platforms like
While the potential benefits are significant, carefully adversarial attacks, inference risks, and data privacy issues.
considering and addressing these challenges is essential This paper [4] aims to highlight the dual usage of AI/ML in
for responsible and effective AI deployment in this cybersecurity, for both defense and attacks, to propose a
critical domain. taxonomy classifying different types of AI/ML-enabled
cyberattacks. Both AI/ML methods were used in the study to
⚫ AI holds great promise for advancing cybersecurity examine how AI/ML can be leveraged for good through
through its unparalleled data processing and pattern cyber defense as well as weaponized to optimize attacks that
recognition capabilities. However, responsible can bypass traditional defenses. The combination of AI and
development and pragmatic expectations are essential ML techniques enhances cybersecurity through
to maximize benefits and minimize risks when complementary capabilities, adaptive improvement, multi-
deploying AI for cyber defense. pronged defense, accountable ML, scalable deployment, and
efficient human-AI collaboration. The authors of the paper
II. RELATED WORKS
[5] proposed a Systematic Literature Review of Studies on
Cybersecurity MOOCs which aims at the study of outcome
Authors proposed a model for AI driven Cybersecurity of recent intelligent alternatives in network security. Failures
[1] whose primary goal is to act as a resource and set of in AI have the potential to affect society as a whole, thus it's
recommendations for industry professionals and cyber- critical to give citizens and cybersecurity professionals
security researchers, particularly when it comes to AI-based access to cutting-edge training as well as fundamental AI
technological aspects. The methods used for this purpose are knowledge. In most cases, covered subjects rather than
K-Nearest Neighbor, Naive Bayes, Random Forests, methods (such AI) are used by cybersecurity MOOCs to
Adaptive Boosting, RNN, LSTM, CNN, Hidden Markov structure their educational content. [6] proposed which
Model which aids in fulfilling various purposes: Intrusion evaluates how AI might be used to enhance cybersecurity
detection analysis, attack classification, DDos detection and solutions by evaluating its advantages and disadvantages. It
analysis, preventing cyber terrorism etc. Henceforth, also highlights the potential benefits of AI-based
analytics driven structuring may be applied to several cybersecurity solutions in diverting adversaries and reducing
applications which ranges from risks assessment to or eliminating data breaches. Various cybersecurity threats
abnormality detection which may result in a phishing risk as such as Denial of Service (DoS) attacks, Man-in-The-Middle
highlighted in the study. Various states of AI in (MiTM) attacks, Drive-by attacks, Eavesdropping attacks
cybersecurity have been examined in paper [2] L. Chan et al. are being solved using cybersecurity solutions frequently
who presented the analysis of machine intelligence in Cyber carrying out traffic analysis, which categorizes Internet
Security for Information Technology Management that traffic as harmful or lawful. Few algorithms such as naïve
leverages the present mode of AI in the cybersecurity field Bayes, k-Nearest Neighbor (k-NN), decision tree which
and describes several works based use cases of data analytics iteratively determines which feature best fits the samples of
to assist the society identify various network risks and data. Until data samples with just one class are identified
develop complex decisions. With the use of a database after a split, the repeated division generates a succession of
containing malware and threats, AI may be trained to rules for each side of the categories, producing a structure
classify files or specific behaviors as either supervised or like a tree that is implemented in order to prevent the
unsupervised using supervised and unsupervised machine cyberthreats. Thus (AI)-driven cybersecurity solutions have
learning techniques. Neural Networking where each neuron predominantly concentrated on machine learning
in a neural network represents a point in a multidimensional methodologies that employ intelligent agents to differentiate
space and is connected to its neighbors. When used in between malicious and authentic traffic. In the article,
conjunction with clustering techniques, it aids in the Applications of AI in Cybersecurity [7] proposed by
detection of malicious IP traffic. By computing the behavior authors signifies the key goal of applying AI and ML to
patterns that the system employs, Deep Learning—another help detect anomalous behavior that may indicate new cyber
crucial technique uses predictive powers to identify threats. Rather than a fully automated approach, the authors
problems even before they arise. Consequently, AI proposed a hybrid human-AI strategy where SMB users
contribute knowledge on normal vs abnormal activity to various approaches and classifications of XAI, investigate
account for false positives/negatives. AI and ML algorithms the problems and obstacles that XAI is currently facing,
have been utilized in this paper to detect abnormal actions. ascertain which frameworks and datasets are available for
This human-in-the-loop approach with AI/ML improved XAI-based cyber defense mechanisms, investigate the
performance and accuracy over fully automated applications of XAI in cyber security and the most recent,
systems. Authors proposed a paper [8] where the main successful XAI-based solutions, ascertain the obstacles and
objective of the study was to predict threats using Artificial unfulfilled research needs for XAI applications in cyber
Intelligence in the Cybersecurity Domain. This paper gives a security and identify the most significant findings and
clear view of the AI and ML techniques. An unsupervised futuristic innovative trends for XAI in cyber security. Thus,
learning method called clustering was used in the study few methods were used to collect , analyze the data and
which produces instances of equivalent cluster grouping. some ML/DL techniques were used for prediction and study.
Thus, the process of clustering helps find patterns in data. In After thorough analysis on XAI in cyber security
some circumstances, it is clustered to utilize the resulting applications the fundamental principles and taxonomies of
classified data for supervised learning and unlabeled data. the most recent XAI models were finalized with essential
According to this study, the hunts that adhered to the resources, including accessible datasets and a generic
structured threat model were more tightly centered with the framework. Additionally, they looked into the XAI oriented
project's goals. The phase of feedback is able to comprehend network risks models from a variety of case studies
the significance of judgments made at the scale and stage scenarios, such as using XAI to defend against various
through the official hunting purpose. Artificial Intelligence cyberattacks categories in various industrial applications and
(AI) technologies have been incorporated into cyberspace identifying cyber threats that target XAI models and related
using which report [9] signifies the impact of AI in defensive strategies.
cybersecurity and summarizes existing research in terms of
benefits of AI in cybersecurity. Authors used various
classification and regression algorithms, expert systems also
known as knowledge-based systems along with decision tree, III. PROPOSED MODEL
support vector machine, KNN, random forest in the
cybersecurity domain. Several other algorithms feed forward,
convolutional neural and recurrent neural networks etc come
under DL algorithms. Threats history can be used in an AI-
based system to know about the past threats and use this
knowledge to predict similar attacks in the future applying
various AI methodologies, such as bio inspired computing
and ML/DL methods, or various learning approaches,
including reinforcement learning and supervised learning,
providing new insights. By strategically evaluating the
dangers to virtual machines (VMs), authors in [10]
suggested a unique multiple risks analysis-based VM threat
prediction model (MR-TPM) to safeguard computational
data and prevent adversary breaches. It takes into account
several cybersecurity risk factors related to the setup and
administration of virtual machines (VMs), in addition to
analyzing user behavior. One of the algorithms in use, the
random forest classifier (RFC), uses knowledge generated
by extracted correlated patterns from users' previous data Fig.1 Flow chart of threat detection in cybersecurity using ML
and the learning capacity of various base learners or decision
trees to classify users based on their future behavior. The The flowchart illustrates a comprehensive system for
virtual risks level is recorded with scoring pattern like threat detection and vulnerability assessment which
common vulnerability scoring system (CVSS) which integrates a number of data sources and analytical
determines the extreme degree of risks of an application. In techniques to find and rank potential security concerns. Each
the paper [11] author studied the role of Artificial layer and component of the process has a distinct function
Intelligence in the Cyber Security domain. Here, the main within the larger system. Two main types of input data are
aim of AI was to create technologically based tasks that displayed at the top of the flowchart: "Historical Vulnerable
simulate human understanding in order to solve issues, to Data" and "Standard Security Data." Information from well-
understand the various AI technologies and how important known cybersecurity databases and frameworks, such as
they are for cyber security and to measure how well AI CAPEC (Common Attack Pattern Enumeration and
instruments identify the various cyberattacks. To Classification), ATT&CK (Adversarial Tactics, Techniques,
comprehend the function of artificial intelligence in cyber and Common Knowledge), CWE (Common Weakness
security so as to detect and stop cyberattacks and crimes, Enumeration), and other comparable data sources, may be
cybercrime-related data or reports Security incidents were included in standard security data. These resources offer
gathered using secondary data sources which were then organized data regarding known security flaws and dangers.
analyzed using two statistical tools , they were:- Measures of The National Vulnerability Database (NVD), CVE
central tendency (simple and weighted average and (Common Vulnerabilities and Exposures) entries, numerous
Percentile analysis. The results showed that some of the forums, vulnerability databases (VulDB), and other sources
cyber crimes are down, others are rising. Authors presented are some of the sources from which the Historical
the paper [12] where their main aims were as to go about the Vulnerable Data is acquired. This data is a treasure trove of
historical details regarding exploits and vulnerabilities from IV. RESULT ANALYSIS
the past that have been tracked down throughout time. After
that, these two data streams are integrated to create
Table.1 contrasts the accuracy of various predictive
"Combined Historical Data," which functions as a thorough
analytics models like XGBoost, bagging, boosting, decision
store of security knowledge that includes both historical
tree, random forest and stacking on a specific dataset.
records of vulnerabilities and standardized frameworks. As
XGBoost can very well tackle uneven data samples and
we proceed to the next layer, we come across the "Online
complicated data, reduce overfitting, optimized for speed
Data Analysis Layer," which is in charge of instantly
and scale, ensembling improves stability and achieves high
processing and evaluating the merged historical data. This
accuracy in various classification and regression problems
layer is divided into a number of steps that go sequentially,
since it shows the highest accuracy among the listed
beginning with "Data Processing." In order to ensure that the
algorithms hence the best algorithm for performing the task
raw data is in the right format and devoid of errors or
assigned.
unnecessary information, it is cleaned, normalized, and
made ready for additional analysis [13-15].
Table.1 Ensemble Machine Learning Classification Techniques.
The "Feature Extraction" step happens after data
processing. In this stage, particular traits or qualities that are
important for locating vulnerabilities are taken out of the Algorithms Accuracy
processed data [16-17]. The analytical models will use these
properties to identify trends and forecast outcomes. The next
step is "Feature Selection," in which the extracted set's most XGBoost 98%
important features are selected. This is an important stage
since it helps to focus on the most informative qualities and Bagging 97.62%
lower the dimensionality of the data, which improves the
effectiveness of the models. It is followed by "ML Model
Training/Evaluation." The chosen features are used to train Boosting 94%
machine learning (ML) models, which help them identify
patterns and anticipate vulnerabilities. The efficacy and
accuracy of these models in spotting possible dangers are Decision Tree 93.49%
also assessed. The term "Model Selection Ensemble" implies
that various machine learning models can be employed in Random Forest 95.77%
tandem, with the top-performing models or a blend of
models (ensemble) being chosen to yield the most precise
outcomes. "Model Deployment" is the last stage in the Stacking 92.32%
Online Data Analysis Layer, where the selected model or
group of models is put into use for threat detection and real-
time analysis. A feedback loop from the "Real-Time Table.2 Types of Cyber Threats with training and testing accuracy using
XGBoost
Network" layer, which symbolizes the operational setting in
which the deployed models are actively collecting and
evaluating data, is also depicted in the flowchart. This layer Cyber- Training Accuracy Testing
contains a variety of data kinds, including emails, databases, Accuracy
file storage, stream data, SQL injections, network traffic, Threats
and both organized and unstructured data. There is an
interface with a "Domain Expert" on the right side of the
DDoS 97.8% 92.76%
flowchart, who probably offers expert knowledge and
insights to improve the system. Additionally, the Domain
Expert might contribute to "Security cleared Traffic Data," DoS 96.2% 94.34%
which could be utilized as extra training data for the ML
models or as a means of validating the results of the system.
Additionally, "Ranking Vulnerability," which ranks MiTM 95.47% 92.33%
vulnerabilities according to severity, impact, or other factors,
is a result of the Domain Expert's input. In order to Malware 96.72% 93.19%
concentrate efforts on the most important topics, this ranking
is crucial. Finally, as a result of the Domain Expert's
contribution, "Pattern Generation" is mentioned, implying Phishing 92.21% 93.58%
that new patterns of attacks or vulnerabilities may be found
and introduced to the system for improved detection Spyware 92.44% 94.29%
capabilities. To summarize, the flowchart presents a
multifaceted and intricate strategy for cybersecurity that
combines machine learning, expert knowledge, and Password Attack 99.18% 98.26%
historical data to identify, evaluate, and handle
vulnerabilities instantly. The system is meant to be dynamic, Cryptojacking 92.82% 93.46%
constantly improving its threat identification and prioritizing
skills by absorbing new information and expert insights.
 Table.2 signifies that most of the cyber threats have a [5] Laato, S., Farooq, A., Tenhunen, H., Pitkamaki, T., Hakkala, A., &
high detection accuracy rate, both during training and testing. Airola, A. (2020). AI in Cybersecurity Education- A Systematic
Literature Review of Studies on Cybersecurity MOOCs. 2020 IEEE
Nonetheless, there are some differences in accuracy 20th International Conference on Advanced Learning Technologies
throughout various categories of threats. For instance, the (ICALT), 6-10.
accuracy rate of password attacks is above 98%, although [6] Zeadally, S., Adi, E., Baig, Z.A., & Khan, I.A. (2020). Harnessing
the accuracy rate of phishing attempts is just about 93%. Artificial Intelligence Capabilities to Improve Cybersecurity. IEEE
With the majority of threats having a testing accuracy of Access, 8, 23817-23837.
more than 90%, the security system was able to identify a [7] Hofstetter, M., Riedl, R., Gees, T., Koumpis, A., & Schaberreiter, T.
significant portion of cyber attacks. (2020). Applications of AI in cybersecurity. 2020 Second
International Conference on Transdisciplinary AI (TransAI), 138-
141.
V. CONCLUSION
[8] Sree, V.S., Koganti, C.S., Kalyana, S.K., & Anudeep, P. (2021).
Artificial Intelligence Based Predictive Threat Hunting In The Field
The rapid advancement of cyberattacks creates an urgent of Cyber Security. 2021 2nd Global Conference for Advancement in
Technology (GCAT), 1-6.
need for innovative defenses. Artificial intelligence presents
immense potential to radically enhance cybersecurity [9] Morovat, K., & Panda, B. (2020). A Survey of Artificial Intelligence
in Cybersecurity. 2020 International Conference on Computational
through its unmatched abilities to process enormous datasets, Science and Computational Intelligence (CSCI), 109-115.
detect subtle patterns, and automate security workflows. By [10] D. Saxena, I. Gupta, R. Gupta, A. K. Singh and X. Wen, "An AI-
harnessing AI, we can equip our systems with intelligent Driven VM Threat Prediction Model for Multi-Risks Analysis-Based
protection that evolves along with emerging threats. Cloud Cybersecurity," in IEEE Transactions on Systems, Man, and
However, for AI to fulfill its promise in cybersecurity, we Cybernetics: Systems, vol. 53, no. 11, pp. 6815-6827, Nov. 2023,
must thoughtfully address ethical risks, prioritize model doi: 10.1109/TSMC.2023.3288081.
interpretability, and promote synergy between academia and [11] Shamiulla, Arab Mohammed. "Role of artificial intelligence in cyber
security." International Journal of Innovative Technology and
industry. If we collaborate to steer AI's development Exploring Engineering 9.1 (2019): 4628-4630.
responsibly, it can provide indispensable reinforcements in [12] Z. Zhang, H. A. Hamadi, E. Damiani, C. Y. Yeun and F. Taher,
the endless battle against cyber crime. But we must remain "Explainable Artificial Intelligence Applications in Cyber Security:
vigilant - neither underestimating the ingenuity of hackers State-of-the-Art in Research," in IEEE Access, vol. 10, pp. 93104-
nor overestimating the capabilities of machines. AI is not a 93139, 2022, doi: 10.1109/ACCESS.2022.3204051.
panacea, but rather a powerful asset whose limitations we [13] Biswal, A. K., Avtaran, D., Sharma, V., Grover, V., Mishra, S., &
must recognize. With care and wisdom, AI can become a Alkhayyat, A. (2024). Transformative Metamorphosis in Context to
IoT in Education 4.0. EAI Endorsed Transactions on Internet of
crucial ally in the fight for our digital future. Things, 10.
[14] Verma, S., Mishra, S., Sharma, V., Nandal, M., Garai, S., &
Alkhayyat, A. (2024). Distinctive Assessment of Neural Network
REFERENCES Models in Stock Price Estimation. EAI Endorsed Transactions on
Scalable Information Systems.
[1] Sarker, I.H., Furhad, M.H., & Nowrozy, R. (2021). AI-Driven [15] Das, U., Sharma, V., Das, M., Mishra, S., Iwendi, C., & Osamor, J.
Cybersecurity: An Overview, Security Intelligence Modeling and (2023, December). Vehicular propagation velocity forecasting using
Research Directions. SN Computer Science, 2. open CV. In Proceedings of ICCAKM 2023: 4th International
[2] Chan, L., Morgan, I., Simon, H., Alshabanat, F., Ober, D., Gentry, J., Conference on Computation, Automation and Knowledge
Min, D., & Cao, R. (2019). Survey of AI in Cybersecurity for Management. IEEE.
Information Technology Management. 2019 IEEE Technology & [16] Sharma, S., Pandey, A., Sharma, V., Mishra, S., & Alkhayyat, A.
Engineering Management Conference (TEMSCON), 1-8. (2023, November). Federated Learning and Blockchain: A Cross-
[3] Thuraisingham, B.M. (2020). The Role of Artificial Intelligence and Domain Convergence. In 2023 3rd International Conference on
Cyber Security for Social Media. 2020 IEEE International Parallel Technological Advancements in Computational Sciences
and Distributed Processing Symposium Workshops (IPDPSW), 1-3. (ICTACS) (pp. 1121-1127). IEEE.
[4] Kamoun, F., Iqbal, F., Esseghir, M.A., & Baker, T. (2020). AI and [17] Ajmani, P., Sharma, V., Sharma, S., Alkhayyat, A., Seetharaman, T.,
machine learning: A mixed blessing for cybersecurity. 2020 & Boulouard, Z. (2023, September). Impact of AI in Financial
International Symposium on Networks, Computers and Technology-A Comprehensive Study and Analysis. In 2023 6th
Communications (ISNCC), 1-7. International Conference on Contemporary Computing and
Informatics (IC3I) (Vol. 6, pp. 985-991). IEEE.