AI-Based Cybersecurity Threat Detection Using Machine Learning

Abstract

Abstract - Rising volumes of sophisticated cyber attacks have rendered conventional signature-driven security tools insufficient for protecting modern digital assets. This study introduces a multi-layered intelligent detection system that unites supervised learning, unsupervised anomaly analysis, and ensemble decision strategies to identify network intrusions, malicious software activity, and stealthy advanced persistent threats in near real time. The pipeline begins with rigorous data cleansing and feature refinement that combines mutual-information ranking with principal-component analysis. Classification is performed by a soft-voting ensemble of Random Forest, gradient-boosted trees (XGBoost), and a compact deep neural network. Parallel anomaly scoring is obtained from Isolation Forest and a reconstruction-error autoencoder trained solely on benign flows. Evaluation on the NSL-KDD, CIC-IDS2017 and UNSW-NB15 collections yields detection accuracy reaching 98.7 %, precision of 97.9 %, recall of 98.4 % and an F1-score of 98.1 %, accompanied by a low rate of false alarms. SHAP-based explanations are attached to every prediction, giving security analysts transparent insight into model behaviour. Comparative benchmarks against recent published methods confirm that the proposed architecture delivers both higher accuracy and practical deployability inside enterprise security operations centres. Key Words: network intrusion detection, ensemble machine learning, anomaly scoring, deep autoencoder, explainable artificial intelligence, cyber-attack classification, security operations.