AI-DRIVEN CYBER THREAT DETECTION: A FRAMEWORK FOR REAL-TIME IDENTIFICATION AND PREVENTION OF NETWORK ATTACKS

Abstract

Modern enterprise and cloud networks and the Internet-of-Things generate large amounts of data, and malicious activity can occur in small bursts, be spread out across networks, be encrypted, or be deliberately disguised as legitimate activity. The authors present a data-science perspective on real-time cyber-threat detection and detection-driven prevention, with a particular focus on policy-controlled prevention that relies on explainability, supervised learning, and anomaly-oriented learning from streaming flows, and on statistical and temporal feature engineering. The study is not meant to be a statement of a new laboratory experiment but rather a synthesis of secondary benchmarks and a framework. It provides the reproducible datasets such as UNSW-NB15, CICIDS2017, and TON_IoT to develop and evaluate models, and summarizes the latest peer-reviewed studies to inspire models. The system is designed to detect the attack quickly while maintaining its interpretability, while also using the slower computer-based inference system for explanation and retraining for analysts. It suggests accuracy, precision, recall, F1-score, ROC-AUC, false-positive rate, detection latency, throughput, calibration, and distribution drift and class imbalance as evaluation metrics. The evidence published to date indicates that the use of tree ensembles, hybrid deep-learning systems, Transformer-based models, few-shot methods, and explainable AI can all help with network intrusion detection, with the need to map high benchmark scores to production use depending on the datasets and protocols. Leakage-safe splitting, cost-sensitive validation, drift monitoring, confidence-aware response, and human oversight are thus emphasized in the paper. The resulting architecture offers a practical blueprint for adaptive, explainable and operationally deployable network defense.