Authors: Ms. Shapna Priya. S, Haripriya S
Abstract: Increasing complexity and speed of modern cyber attacks necessitate the evolution of security detection and response from traditional signature-based techniques to more effective approaches that can cope with new challenges. This work provides a general architecture for an AI-powered cybersecurity solution that includes a combination of deep learning-based anomaly detection with reinforcement learning-assisted automatic response execution. The framework consists of three layers of functionality: a temporal convolutional feature extractor for network traffic representation, a hybrid detector that relies on a combination of autoencoder reconstruction error and supervised classification, and a proximal policy optimization agent that performs containment actions based on detected threat level and state information. The approach is validated using benchmark datasets of CICIDS-2017 and UNSW-NB15, where it consistently outperforms the existing solutions in terms of detection precision, recall, and F1-score when compared to random forest, classic LSTM, and isolation forest models. In terms of automated response, the solution provides an order-of-magnitude improvement in mean time to respond compared to playbook-based execution.
DOI: http://doi.org/
