Intelligent Cybersecurity Analytics for Supply Chain Resilience: Integrating AI, Machine Learning, and Big Data for Proactive Threat Hunting

Abstract

Today, supply chains are intricate digital ecosystems that include suppliers, logistics providers, industrial Internet of Things (IIoT) assets, cloud platforms and software, and adversaries are leveraging these trust relationships as a first step to gaining access. Signature-driven and purely supervised detectors provide excellent protection against known tactics but suffer dramatically when an attacker introduces tactics not seen in historical data – which is exactly what proactive threat hunting must account for. This paper introduces ICA-SCR, an Intelligent Cybersecurity Analytics framework for Supply Chain Resilience, which integrates a big data ingestion and feature layer, a supervised gradient-boosting channel for known threats, a benign-calibrated unsupervised anomaly channel (autoencoder and isolation forest) for unknown threats, and a Dual-Channel Hunting Fusion (DCHF) rule that transforms both channels into analyst-ready hunt priorities, along with a SHAP-based explainability layer. The framework is tested on two publicly available datasets, NSL-KDD (148,517 records) and UNSW-NB15 (257,673 records), against seven supervised and two unsupervised baselines under six protocols, which include binary detection, cross-validation, novel-attack hunting, leave-one-category-out zero-day simulation, multi-class attribution and streaming scalability. On NSL-KDD, where the test partition includes 17 attack types not present in the training partition, ICA-SCR improved the F1-score from 0.761 to 0.838 and the MCC from 0.615 to 0.706 compared to its own supervised channel, while the false-positive rate increased from 2.81% to 3.14% (McNemar χ² = 1323.9, p < 0.001). The number of attacks of new types detected more than doubled (30.3% to 64.5%). The supervised channel already generalised well on UNSW-NB15, where attack categories share strong traffic signatures, and fusion added a small but statistically significant false-alarm cost, which delineates when the anomaly channel adds value. The scoring pipeline achieved approximately 43,000 records per second on a 2-core CPU. These findings reveal that supervised and benign-calibrated anomaly analytics is a feasible and comprehensible path to proactive threat hunting in supply chain settings and quantify the compromises practitioners must make.