AI-DRIVEN THREAT DETECTION AND AUTOMATED RESPONSE IN MODERN CYBERSECURITY SYSTEMS: A SYSTEMATIC REVIEW AND FRAMEWORK
TL;DR
A conceptual framework is proposed that combines detection, explanation, and orchestrated response in a continuous feedback loop that is suitable for zero trust and IoT-enabled critical-infrastructure environments that will allow for continuous retraining of the model.
Abstract
As the number and sophistication of cyberattacks increase, including those like ransomware, advanced persistent threats (APTs), and zero-day exploits, the structural weaknesses of signature-based and static intrusion detection systems (IDS) become evident as they fail to generalize to novel or adversarially crafted attack patterns Agbroko (2024), Hakke et al. (2025). The paper provides a systematic review of the application of modern security operations in threat detection and automated incident response using classical machine learning (ML), deep learning (DL), reinforcement learning (RL), and metaheuristic optimization. A review of some of the benchmark sets shows that the ensemble and hybrid AI models consistently yield detection accuracy rates of 97–99% on curated datasets like NSL-KDD, CICIDS2017, and UNSW-NB15, which is significantly higher than the detection accuracy rates of legacy rule-based tools Waghmode and Kanumuri (2025), Sah et al. (2023), Jairu (2021). The paper also reviews Security Orchestration, Automation and Response (SOAR) integration, reinforcement-learning-driven adaptive defense policies, and threat-intelligence feedback loops that will allow for continuous retraining of the model. Some persistent challenges include adversarial evasion and data-poisoning attacks, false positives causing alert fatigue, interpretability problems in deep models, and autopilot restrictions on autonomous response actions Jha (2025), Dong et al. (2018). The most significant frontiers for making this leap from high laboratory accuracy to robust, audit- and legally sound operational deployments are explainable AI (XAI), federated and privacy-preserving learning, and standardized benchmarking Hermosilla et al. (2025), Bi et al. (2024). A conceptual framework is proposed that combines detection, explanation, and orchestrated response in a continuous feedback loop that is suitable for zero trust and IoT-enabled critical-infrastructure environments Silva (2026).