Authors: Chakave Sakshi Revannath, Prof. M. A. Auti, Prof. M. C. Kolse, Prof. S. K. Said
Abstract: The number and sophistication of cyberattacks, including malware, phishing, ransomware and denial-of-service campaigns, continue to grow, and signature-based security tools struggle to recognize new or modified threats. Machine Learning (ML) offers a complementary approach that learns the characteristics of normal and malicious behaviour from data and flags suspicious activity in real time. This paper reviews ML-based threat detection with emphasis on network intrusion detection. It traces the evolution from the classical intrusion-detection model to rule-based systems, and examines supervised classifiers such as Decision Trees, Random Forests and Support Vector Machines, unsupervised anomaly detectors and deep learning models. Public benchmark datasets, feature engineering from network flows, evaluation metrics and the practical difficulties of class imbalance, concept drift and false alarms are discussed. A layered architecture for a real-time detection system is proposed, comprising traffic capture, feature extraction, a hybrid detection engine, alert management and response integration. A research gap analysis, objectives and a comparative analysis of algorithms are presented. The review concludes that ensemble ML models combined with explainable alerts and continuous retraining can significantly improve detection accuracy and reduce false alarms in operational security environments.
DOI: https://doi.org/10.5281/zenodo.24219742
