Enhanced Cybersecurity Ecosystem with Explainable and Generative Intelligence for Scalable Network Protection

Abstract

As the number of network attacks continues to increase, cybersecurity systems require intelligent and scalable solutions to detect more and more complex network attacks in real time. This paper suggests an end-to-end intelligent cybersecurity system for detecting intrusion with CICIDS2017 dataset with multiple classes. Proposed system performs complete data pre-processing that consists of missing value removal, duplication elimination, label encoding, feature normalisation and Principal Component Analysis based feature selection to enhance the data quality and learning efficiency. Some ML models such as DT, RF, ET, LR, Gaussian Naïve Bayes and a soft Voting Classifier are tested along with DL architectures like DNN, CNN, LSTM, CNN-LSTM, and CNN-LSTM-GRU. In addition, the works of Generative AI models, such as VAE, GAN, and Distil GPT2 are explored for anomaly modelling, generation of minority samples, and generation of text data for cybersecurity applications. XAI techniques (LIME and SHAP) reveal the main network traffic aspects to improve transparency of the forecast. The experimental results indicate that the Voting Classifier obtained the accuracy of 99.6% and the LSTM model obtained the accuracy of 99.3%. Both models can reliably detect various types of cyber attacks. Last, the framework is also deployed as a web application that uses Flask to enable real-time deployment of intrusion prediction and visualisation.