Machine Learning Framework for Predicting Emerging Cyber Threats

Abstract

Modern cyber attacks increasingly involve adaptive adversaries, zero-day exploitation, polymorphic behavior, multistage campaigns, and weak signals distributed across heterogeneous security telemetry. Traditional signature-based intrusion detection systems are effective for known threats but provide limited capability for predicting emerging attacks before they fully materialize. This paper presents THREATPREDICT-AI, a machine learning framework for predicting emerging cyber threats through weak-signal anomaly detection, time-series threat forecasting, graph-based threat correlation, ensemble risk scor-ing, explainable prediction artifacts, audit logging, and Human-in-the-Loop analyst validation. The proposed framework ingests safe cyber telemetry such as SIEM logs, IDS alerts, endpoint events, firewall records, authentication logs, and cyber threat intelligence indicators. It converts raw events into event-level, window-level, temporal, and graph-level features. Anomaly risk, forecast risk, and graph risk are fused into a calibrated threat score and mapped to low, medium, or high risk levels. A Flask-based prototype was implemented with a SOC dashboard, role-based access control, synthetic event generation, prediction management, HITL review, configurable model settings, and audit logs. Experimental demonstration using 220 synthetic cyber events generated 59 prediction windows and detected a high-risk emerging threat window with a final score of 0.83. The results show that combining anomaly, temporal, and graph sig-nals improves proactive threat identification while explainability, auditability, and analyst governance improve operational trust.