AI in Cybersecurity: Threat Detection Overview by IRJET Journal

AI in Cybersecurity: Threat Detection Overview

Vishesh Bharadwaj , Siddharth Kahar , Shubham Jadhav

Computer Science Engineering, Parul University

Abstract- The rapid digitization of public and private services has significantly expanded the attack surface for cyber threats, including malware, phishing, ransomware, botnets, insider misuse, and distributed denial-of-service (DDoS) attacks. While traditional signature-based defenses remain effective against known attack patterns, they are limited in detecting rapidly evolving or previously unseen threats. This paper presents a focused study of Artificial Intelligence (AI) techniques for cybersecurity threat detection, with particular emphasis on machine learning, deep learning, and anomaly detection.

A conceptual architecture is proposed to demonstrate how AI can be integrated into an end-to-end security pipeline, ranging from raw data collection to alert generation and response. In addition, a mini experiment using a Random Forest classifier is conducted to illustrate how AI models can support intrusion detection. The study also includes a comparative analysis, performance evaluation metrics, and visual insights to assess the effectiveness of different approaches.

The findings indicate that AI-driven methods significantly enhance adaptability and enable near-real-time threat detection. However, challenges such as false positives, dependence on high-quality datasets, limited explainability, and computational costs continue to impact their practical deployment.

Index Terms Artificial Intelligence, Cybersecurity, Intrusion Detection System, Machine Learning, Deep Learning, Anomaly Detection.

1. Introduction

Cybersecurity has become essential for governments, enterprises, cloud platforms, healthcare systems, financial institutions, and academic organizations, as modern services are heavily dependent on internet-connected digital infrastructure. As connectivity continues to expand, both the scale and sophistication of cyberattacks are increasing. Attackers now employ advancedtechniquessuchasautomatedphishing, polymorphicmalware,credential theft, botnets,andstealth strategiesthat canbypassstaticrulesandknownsignatures.

Traditional security mechanisms, including antivirus systems, firewalls, and signature-based intrusion detection systems, remain important. However, they are most effective when dealing with previously known attack patterns. Artificial Intelligenceoffersa moreadaptive and dynamicapproach,as itcan learn from data,classifysuspicious behavior,and detect anomaliesinrealtime.InmodernSecurityOperationsCenters(SOCs),AIhelpsreducemanualworkload,enablesfasterthreat triage,andimprovesthedetectionofmaliciousactivitiesacrosslargevolumesofnetworktrafficandlogdata.

ThispaperexamineskeyAItechniquesforcyberthreatdetection,proposesapracticaldetectionarchitecture,comparesmajor approaches,andsupportstheanalysiswithacompactexperimentalstudyusingaRandomForestmodel.

ResearchonAIincybersecurityhasexpandedrapidlyduetothegrowingneedforautomatedanalysisofnetworktraffic,host logs, authentication data, and user behavior. Earlier studies established that machine learning-based intrusion detection can outperform purely signature-based methods in dynamic environments. Classical models such as Decision Trees, Random Forest,SupportVectorMachines,andNaiveBayeshavebeenwidelyusedbecausetheyofferstrongclassificationperformance with manageable implementation complexity. More recent studies have focused on deep learning methods such as Convolutional Neural Networks, Recurrent Neural Networks, and Long Short-Term Memory models, which are useful for extracting complex patterns and temporal dependencies from large datasets. Anomaly detection has also become a major research focus because it enables the identification of previously unseen attacks and insider misuse by learning normal behavior profiles. However, the literature consistently reports several limitations, including false-positive rates, heavy dependence on labeled datasets, computational overhead, class imbalance, lack of interpretability, and vulnerability to adversarial manipulation. These findings indicate that AI is highly promising for cybersecurity, but robust deployment requirescarefulengineering,trusteddatasets,andcontinuousmodelevaluation.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

2. Related Work

PriorworkonAI-enabledthreatdetectionhasdemonstratedthatmachinelearninganddeeplearningmodelscansignificantly improve the detection of both known and unknown threats compared to rule-based systems. Surveys and empirical studies showthatsupervisedlearningapproachessuchasRandomForestandSVMareeffectiveforintrusiondetectionandmalware classification,especiallywhenappliedtobenchmarkdatasetslikeKDD-CUP’99andNSL-KDD.

Recentadvancesfocusondeepnetworksfor trafficclassificationanduser-behavior-basedthreatdetection, whereCNNsand RNN/LSTMarchitectureslearnrichtemporal andspatial patternsfrom raw or pre-processedlogs.Anomaly-detection-based frameworks,oftenusingclustering,isolationforests,orautoencoders,furtherextendcoveragetozero-dayandinsider-threat scenarios.Despitethesebenefits,researchersemphasizeissuessuchashighfalse-positiverates,datasetimbalance,andmodel opacity,whichmotivatetheneedforhybrid,explainable,andresilientdesigns.

3. AI Techniques in Threat Detection

3.1

Machine Learning

Machine learning approaches learn patterns from labeled cybersecurity datasets and classify records as either benign or malicious. Decision Trees are highly interpretable and easy to understand, while Random Forest improves reliability by combining multiple trees through ensemble learning. Support Vector Machines (SVM) are effective in handling complex classification spaces, especially when data is sparse. Naive Bayes (NB) remains useful for fast, probabilistic detection. These algorithmsare widelyapplied in use casessuchasintrusion detectionsystems, spamfiltering, malware family classification, frauddetection,andbehavioralanalytics.

3.2 Deep Learning

Deep learning methods automatically extract hierarchical features from large and complex datasets. Convolutional Neural Networks(CNNs)areeffectivewhennetworktrafficfeaturescanberepresentedinastructuredformat.Incontrast,recurrent models such as Recurrent Neural Networks (RNNs) and Long Short-Term Memory (LSTM) networks are well-suited for analyzing sequential and temporal data, such as log streams or user sessions. Deep learning techniques are particularly valuableforadvancedpersistentthreatdetection,large-scaletrafficmonitoring,anduserbehavioranalysis.

3.3 Anomaly Detection

Anomalydetectionfocusesonidentifyingpatternsthatdeviatefromestablishednormalbehavior.Thisapproachisespecially useful when labeled attack data is limited or when the goal is to detect zero-day attacks, insider threats, and previously unknown fraudulent activities. Common techniques include statistical methods, clustering algorithms, isolation-based approaches,andhybridmodels,allofwhicharewidelyusedforanomaly-basedthreatdetection.

4. Proposed System Architecture

The proposed AI-based threat detection architecture is organized into six sequential stages. First, data is collected from multiplesources,including network traffic,systemlogs, endpointactivity,andauthentication events.Second,theraw data is preprocessedthroughcleaning,transformation,normalization,andencodingtoensureconsistencyandaccuracyforanalysis. Third,featureengineeringisperformedtoselectthemostrelevantattributesand,wherenecessary,reducedimensionalityto improvemodelefficiency.

Fourth, the AI model layer applies machine learning and anomaly detection techniques to classify behavior and identify suspicious deviations. Fifth, the threat detection engine converts the model outputs into actionable alerts, risk scores, and security events for analysts. Finally, the response layer executes appropriate actions such as logging, blocking, escalation, or quarantiningpotentialthreats.

Thislayeredarchitectureis practical becauseitillustrateshowAIcanbeintegrated intoa completecybersecurityworkflow, ratherthanfunctioningasanisolatedmodel.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

1.ProposedAI-basedthreatdetectionarchitecture.

(Insert a block-diagram in Word: Data Sources → Preprocessing → Feature Engineering → AI Model Layer → Threat Detection Engine → Response Layer, with labeled arrows.)

5. Comparative Analysis

Threat detection techniques can be evaluated based on factors such as accuracy, detection speed, the ability to identify new threats, and implementation complexity. Traditional signature-based approaches are simple and lightweight, making them easy to deploy; however, they struggle to detect previously unseen or zero-day attacks. Machine learning methods offer a balanced trade-off between adaptability and operational complexity, enabling systems to learn from data and improve over time. These methods can also adapt to changing attack patterns more effectively than static rule-based systems. As a result, theyarewidelyusedinmodernintrusiondetectionenvironmentswherelargevolumesofdatamustbeanalyzedefficiently.

Fig.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

Deeplearningtechniquesprovideevenstrongerpatternrecognitionandhigherdetectioncapabilities;however,theyrequire largedatasets,significantcomputationalresources,andspecializedexpertise.Inpractice,themosteffectiveapproachisoften ahybridonethatcombinessignature-baseddetectionwithmachinelearningclassificationandanomaly detection. This integrated strategy enhances resilience against both known and emerging threats. It also improves detection coverage by leveraging the strengths of each method while reducing individual weaknesses. Therefore, hybrid security frameworks are increasingly preferred in real-world environments where accuracy, scalability, and adaptability are all essential.

TABLE I. COMPARISON OF THREAT DETECTION TECHNIQUES

Fig. 2. Relativeaccuracycomparisonofthreatdetectiontechniques. (In Word, insert a bar chart or line plot comparing Traditional, ML, and DL accuracy.)

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

6. Mini Experiment and Results

ToillustratetheroleofAIincybersecuritythreatdetection,aminiexperimentwasconductedusinga datasetgeneratedbased on NSL-KDD feature distribution for experimental validation network features. The dataset included attributes such as connectionduration,sourcebytes,destinationbytes,failedloginattempts,connectioncount,andservicecount.Priortomodel training,thedatawerenormalizedtoensureconsistencyandenhancemodelperformance.Thedatasetwasthendividedinto trainingandtestingsetsusingan80/20split.

A Random Forest classifier was selected due to its robustness, ability to model non-linear relationships, and resistance to overfitting, making it well-suited for intrusion detection tasks. The model achieved strong performance, with an accuracy of approximately0.88, a precision of0.87, a recall of0.89, and an F1-score of0.88. The confusion matrix indicates that the classifiercorrectlyidentifiedthemajorityofbothbenignandmaliciousinstances, withsignificantlyfewerfalsepositives and falsenegativescomparedtobaselineapproaches.

These results demonstrate that AI-based techniques can provide effective threat detection even in controlled experimental settings.Atthesametime,theyhighlighttheimportanceofhigh-qualitydatasetsandmoreadvancedmodelstoachievebetter generalizationandreliabilityinreal-worldcybersecurityenvironments.

The model shows strong classification capability due to ensemble learning, which reduces variance and improves generalization.However,performancemayvaryinreal-worlddatasetsduetonoiseandclassimbalance.

Fig. 3. ConfusionmatrixoftheRandomForestminiexperiment. (In Word, insert a 2×2 or labeled confusion-matrix table: True Positive, False Positive, False Negative, True Negative.)

7. Performance Metrics

Several performance metrics are important when evaluating cybersecurity detection models. Accuracy measures the total proportion of correct predictions, but it can be misleading when the dataset is imbalanced. Precision indicates how many predicted attacks are actually malicious, which is important when false alerts are costly. Recall measures how many real attacks are successfully detected, which is critical in security operations because missed attacks can lead to severe damage.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

TheF1-scorebalancesprecisionandrecallandisusefulwhenbothareequallyimportant.FalsePositiveRateisalsosignificant becauseahighvolumeoffalsealarmscancreatealertfatigueandreduceanalystconfidenceinthesystem.

8. Advantages

AI-based threat detection offers several significant advantages. It can operate in real time or near real time, even when handling large volumes of events. By automating pattern recognition and alert generation, it reduces the need for extensive manual analysis. Unlike fixed-rule systems, AI-driven approaches are more adaptable and can adjust as threat behaviors evolve. Additionally, they are capable of identifying previously unknown threats through anomaly-based learning. These strengths make AI an essential component in modern security applications, including security operations centers, cloud security,frauddetection,andtheprotectionofcriticalinfrastructure.

9. Challenges

Despite its strengths, AI in cybersecurity presents several challenges. Detection quality depends heavily on dataset quality, diversity,andtimeliness.Imbalancedoroutdateddatacanreducemodel reliability. Falsepositivesmayoverwhelmanalysts, whilefalsenegativesmayallowdangerousactivitytopassunnoticed.Deepmodelscanalsobecomputationallyexpensiveand difficulttoexplaintodecision-makersorauditors.Anotherconcernisadversarialmanipulation,inwhichattackerscraftinputs that intentionally deceive models. For these reasons, AI should be treated as a strong component of layered defense rather thanacompletereplacementforexpertsupervision.

10. Real-World Applications

AI-driven cybersecurity already plays a vital role across multiple sectors. In banking and digital payments, AI is widely used forfrauddetectionandcontinuousaccountmonitoring.Inhealthcare,ithelpssafeguardsensitivemedicalrecordsanddetect suspicious access patterns. In e-commerce, AI supports transaction monitoring and identifies abnormal user behavior to prevent fraud. In cloud environments, it is applied to traffic analysis, intrusion detection, and automated incident response. Additionally, AI is extensively used in phishing detection, spam filtering, malware classification, and endpoint behavior analytics. These applications demonstrate that AI has moved beyond theoretical concepts and now serves as a critical componentinpracticalandoperationalcyberdefense.

11. Future Scope

FutureworkinAI-basedcybersecurityislikelytoemphasizeexplainability,privacy-preservinglearning,strongerIoTsecurity, andsemi-autonomousdefensesystems.ExplainableAIisessentialbecauseanalystsmustunderstandwhyamodelhaslabeled aneventasmalicious.Federatedandprivacy-preservinglearningapproachescanenablecollaborationwithoutexposing raw sensitive data. AI for Internet of Things security is particularly important because IoT devices often have weak built-in defensesbutcreatelargeattacksurfaces.Hybridsystemsthatcombinesignatures,anomalydetection,anddeeplearningmay provide stronger long-term defense than any single method alone. Over time, autonomous defense mechanisms may handle low-riskactionsautomaticallywhilehumansremainresponsibleforhigh-riskdecisionsandinvestigations.

12. Conclusion

Artificial Intelligence has become a powerful tool in modern cybersecurity, as it enhances the ability to detect evolving and previously unseen threats. Techniques such as machine learning, deep learning, and anomaly detection each offer distinct advantagesforcyberdefense,rangingfromefficientclassificationtoadvancedbehavioralanalysis.Theproposedarchitecture inthispaper demonstrates howtheseAImethodscan beintegratedintoa practical threatdetection pipeline, whilethemini experimenthighlightsboththepotentialandcurrentlimitationsofaRandomForest-basedapproach.

Althoughtheexperimentproducedmoderateresults,itstillsupportsthebroaderperspectivethatAI-drivensystemsaremore adaptable than traditional fixed-rule mechanisms. Future work should focus on improving dataset quality, reducing false positive rates, enhancing model explainability, and increasing robustness against adversarial attacks. With these advancements, AI-based systems can serve as a more reliable and effective foundation for next-generation cybersecurity defense.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

References

1. S. Dhal, S. K. Sahoo, and S. K. Dash, “AI Enabled Threat Detection: Leveraging Artificial Intelligence for AdvancedCybersecuritySolutions,” IEEE Access,vol.12,pp.173127–173154,2024.

M.Tavallaee,E.Bagheri,W.Lu,andA.A.Ghorbani,“ADetailedAnalysisoftheKDDCUP99DataSet,”in Proc. 2009 IEEE Symp. Comput. Intell. Security Defense Appl. (CISDA),Ottawa,ON,Canada,2009.

3. I.Goodfellow,Y.Bengio,andA.Courville, Deep Learning.Cambridge,MA,USA:MIT Press, 2016M.O.Afolabi, “AI integration in cybersecurity software: Threat detection and response,” Int. J. Innov. Res. Sci. Stud., vol. 8, no.3,pp.3907–3921,2025.

4. A. L. Buczak and E. Guven, “A Survey of Data Mining and Machine Learning Methods for Cyber Security IntrusionDetection,” IEEE Commun. Surveys Tuts.,vol.18,no.2,pp.1153–1176,2016.

I.H.Sarker,“Machinelearning:Algorithms,real-worldapplicationsandresearchdirections,” SN Comput. Sci., vol.2,no.3,Art.no.160,2021.

6. R. Vinayakumar, M. Alazab, K. P. Soman, P. Poornachandran, and S. Venkatraman, “Deep Learning Approach forIntelligentIntrusionDetectionSystem,” IEEE Access,vol.7,pp.41525–41550,2019.