A Comprehensive Review of Driven Framework for Intelligent Attack Detection and Dynamic Security Monitoring in Modern Digital Infrastructure

Abstract

The rapid growth of cloud computing, Internet of Things (IoT) devices, enterprise networks, and interconnected digital services has increased the complexity of cybersecurity threats. Traditional signature-based security mechanisms often struggle to identify zero-day attacks, evolving malware, and previously unseen malicious activities. This review paper examines the application of Artificial Intelligence (AI), Machine Learning (ML), and Deep Learning (DL) in intelligent cyberattack detection and dynamic security monitoring. It reviews commonly investigated algorithms, including Random Forest, Extreme Gradient Boosting (XGBoost), Support Vector Machine (SVM), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), and anomaly detection techniques. Existing research is compared in terms of detection capability, computational requirements, adaptability, false-positive rates, and deployment challenges. The review also examines network traffic analysis, behavioral monitoring, real-time alert generation, and automated incident response. Major challenges include imbalanced datasets, concept drift, adversarial attacks, limited generalization to unseen threats, and the difficulty of deploying computationally intensive models in resource-constrained environments. The review identifies opportunities for hybrid AI architectures, explainable detection, privacy-preserving collaborative learning, and feedback-driven security monitoring. It concludes that combining accurate threat classification with continuous monitoring and carefully controlled response mechanisms represents a promising direction for improving cybersecurity resilience across modern digital infrastructure.

Introduction

The text focuses on the application of Artificial Intelligence (AI) for cyberattack detection and dynamic security monitoring in modern digital environments. With the increasing use of cloud computing, enterprise networks, IoT devices, and online services, cybersecurity threats such as malware, ransomware, phishing, denial-of-service attacks, and unauthorized access are becoming more complex. Traditional signature-based intrusion detection systems are effective at identifying known threats but often fail to detect new or previously unseen attacks. Anomaly-based detection helps address this limitation but may generate false alarms due to legitimate changes in network behaviour.

AI and machine learning offer promising solutions by analysing large volumes of network traffic, system logs, and security events. These technologies can identify known attack patterns, detect unusual activities, recognize complex relationships, and support continuous security monitoring. However, practical challenges such as imbalanced datasets, concept drift, adversarial attacks, computational overhead, and false-positive alerts can affect system reliability.

The literature review examines the evolution of intrusion detection systems from traditional rule-based approaches to machine learning, deep learning, hybrid architectures, and adaptive security frameworks. Previous studies highlight the importance of robust detection, real-time traffic analysis, IoT security, federated learning, model interpretability, and privacy-preserving techniques. Despite significant progress, challenges remain in achieving reliable performance across different network environments.

The study discusses several AI algorithms for cyberattack detection:

• Machine Learning: Random Forest, XGBoost, and Support Vector Machine (SVM) are useful for classifying structured network traffic and identifying known attack patterns.

• Deep Learning: Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM), and Transformer-based models can learn complex features and sequential relationships in network activities.

• Anomaly Detection: Isolation Forest and Autoencoders identify unusual network behaviour without requiring all attack categories to be labelled.

• Hybrid Approaches: Combining supervised learning, anomaly detection, and deep learning can improve threat coverage, although it may increase computational complexity.

The text also explores dynamic security monitoring techniques, including network traffic analysis, behavioural monitoring, alert generation, threat prioritization, and incident response. These techniques enable continuous observation of network activities, identification of suspicious behaviour, and generation of alerts for security personnel. Threat prioritization considers factors such as attack severity, model confidence, asset importance, and potential operational impact. Any automated response must include appropriate authorization, safeguards, and audit mechanisms.

The comparative analysis emphasizes that the performance of AI-based intrusion detection systems depends on dataset quality, attack distribution, feature selection, evaluation methods, and computational resources. Therefore, detection accuracy alone is insufficient to establish the practical effectiveness of a cybersecurity system. False-positive rates, detection speed, scalability, adaptability, and robustness must also be considered.

Conclusion

This review examined the role of Artificial Intelligence, Machine Learning, and Deep Learning in intelligent cyberattack detection and dynamic security monitoring. The literature demonstrates that Random Forest, XGBoost, SVM, CNN, LSTM, anomaly detection, and hybrid approaches offer different capabilities for analyzing network traffic and identifying malicious behavior. However, no single technique provides universally reliable performance across all environments. Important challenges include unseen attacks, false-positive alerts, dataset limitations, concept drift, adversarial manipulation, computational overhead, and integration with incident-response processes. These challenges indicate that effective cybersecurity requires more than high classification accuracy. Detection reliability, processing speed, explainability, adaptability, and operational safeguards must also be considered. Future research should investigate integrated AI frameworks that combine attack classification, anomaly detection, continuous monitoring, threat prioritization, and carefully validated model updates. Privacy-preserving learning, lightweight architectures, and explainable security decisions also offer promising directions. Overall, the literature supports continued development of AI-driven cybersecurity frameworks capable of improving threat visibility and assisting timely security decisions. Their practical value, however, must be established through reproducible experiments and realistic deployment evaluations rather than assumed from model architecture alone.

References

[1] A. Hozouri, A. Mirzaei, and M. Effatparvar, “A comprehensive survey on intrusion detection systems with advances in machine learning, deep learning and emerging cybersecurity challenges,” Discover Artificial Intelligence, vol. 5, Art. no. 314, 2025. [Online]. Available: https://doi.org/10.1007/s44163-025-00578-1 [2] H. M. R. U. Rehman et al., “A systematic literature study of machine learning techniques based intrusion detection: Datasets, models, challenges, and future directions,” Journal of Big Data, vol. 12, Art. no. 264, 2025. [Online]. Available: https://doi.org/10.1186/s40537-025-01323-2 [3] Z. Yang, X. Liu, T. Li, D. Wu, J. Wang, Y. Zhao, and H. Han, “A systematic literature review of methods and datasets for anomaly-based network intrusion detection,” Computers & Security, vol. 116, Art. no. 102675, 2022. [Online]. Available: https://doi.org/10.1016/j.cose.2022.102675 [4] S. Hore, J. Ghadermazi, A. Shah, and N. D. Bastian, “A sequential deep learning framework for a robust and resilient network intrusion detection system,” Computers & Security, vol. 144, Art. no. 103928, 2024. [Online]. Available: https://doi.org/10.1016/j.cose.2024.103928 [5] M. Sajid et al., “Enhancing intrusion detection: A hybrid machine and deep learning approach,” Journal of Cloud Computing, vol. 13, Art. no. 123, 2024. [Online]. Available: https://doi.org/10.1186/s13677-024-00685-x [6] Y. A. Farrukh, S. Wali, I. Khan, and N. D. Bastian, “AIS-NIDS: An intelligent and self-sustaining network intrusion detection system,” Computers & Security, Art. no. 103982, 2024. [Online]. Available: https://doi.org/10.1016/j.cose.2024.103982 [7] “A real-time deep learning-based approach for detecting network attacks,” Big Data Research, vol. 36, Art. no. 100446, 2024. [Online]. Available: https://doi.org/10.1016/j.bdr.2024.100446 [8] B. Ahmad, Z. Wu, Y. Huang, and S. Ur Rehman, “Enhancing the security in IoT and IIoT networks: An intrusion detection scheme leveraging deep transfer learning,” Knowledge-Based Systems, vol. 305, Art. no. 112614, 2024. [Online]. Available: https://doi.org/10.1016/j.knosys.2024.112614 [9] A. Belenguer, J. A. Pascual, and J. Navaridas, “A review of federated learning applications in intrusion detection systems,” Computer Networks, vol. 258, Art. no. 111023, 2025. [Online]. Available: https://doi.org/10.1016/j.comnet.2024.111023 [10] I. Makris et al., “A comprehensive survey of federated intrusion detection systems: Techniques, challenges and solutions,” Computer Science Review, vol. 56, Art. no. 100717, 2025. [Online]. Available: https://doi.org/10.1016/j.cosrev.2024.100717 [11] “Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems,” Engineering Applications of Artificial Intelligence, Art. no. 109143, 2025. [Online]. Available: https://doi.org/10.1016/j.engappai.2024.109143 [12] “Adversarial robustness of deep learning-based intrusion detection systems: A systematic literature review of attacks, defenses, datasets, and open challenges,” IEEE Access, vol. 14, pp. 149555–149591, 2026. [Online]. Available: https://doi.org/10.1109/ACCESS.2026.3733985 [13] N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in Proc. Military Communications and Information Systems Conference (MilCIS), 2015, pp. 1–6. [Online]. Available: https://doi.org/10.1109/MilCIS.2015.7348942 [14] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proc. Int. Conf. Information Systems Security and Privacy (ICISSP), 2018, pp. 108–116. [Online]. Available: https://doi.org/10.5220/0006639801080116 [15] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed analysis of the KDD CUP 99 data set,” in Proc. IEEE Symp. Computational Intelligence for Security and Defense Applications, 2009. [Online]. Available: https://doi.org/10.1109/CISDA.2009.5356528 [16] M. A. Ferrag, L. Maglaras, S. Moschoyiannis, and H. Janicke, “Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study,” Journal of Information Security and Applications, vol. 50, Art. no. 102419, 2020. [Online]. Available: https://doi.org/10.1016/j.jisa.2019.102419 [17] A. L. Buczak and E. Guven, “A survey of data mining and machine learning methods for cyber security intrusion detection,” IEEE Communications Surveys & Tutorials, vol. 18, no. 2, pp. 1153–1176, 2016. [Online]. Available: https://doi.org/10.1109/COMST.2015.2494502 [18] A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, “Survey of intrusion detection systems: Techniques, datasets and challenges,” Cybersecurity, vol. 2, Art. no. 20, 2019. [Online]. Available: https://doi.org/10.1186/s42400-019-0038-7 [19] R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in Proc. IEEE Symp. Security and Privacy, 2010, pp. 305–316. [Online]. Available: https://doi.org/10.1109/SP.2010.25 [20] J. Gama, I. Žliobait?, A. Bifet, M. Pechenizkiy, and A. Bouchachia, “A survey on concept drift adaptation,” ACM Computing Surveys, vol. 46, no. 4, Art. no. 44, 2014. [Online]. Available: https://doi.org/10.1145/2523813 [21] B. Biggio and F. Roli, “Wild patterns: Ten years after the rise of adversarial machine learning,” Pattern Recognition, vol. 84, pp. 317–331, 2018. [Online]. Available: https://doi.org/10.1016/j.patcog.2018.07.023 [22] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in Proc. Int. Conf. Learning Representations (ICLR), 2015. [Online]. Available: https://arxiv.org/abs/1412.6572 [23] R. Vinayakumar et al., “Deep learning approach for intelligent intrusion detection system,” IEEE Access, vol. 7, pp. 41525–41550, 2019. [Online]. Available: https://doi.org/10.1109/ACCESS.2019.2895334 [24] N. Shone, T. N. Ngoc, V. D. Phai, and Q. Shi, “A deep learning approach to network intrusion detection,” IEEE Transactions on Emerging Topics in Computational Intelligence, vol. 2, no. 1, pp. 41–50, 2018. [Online]. Available: https://doi.org/10.1109/TETCI.2017.2772792 [25] N. Moustafa and J. Slay, “The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 dataset and the comparison with the KDD99 dataset,” Information Security Journal: A Global Perspective, 2016. [Online]. Available: https://doi.org/10.1080/19393555.2015.1125974 [26] A. H. Lashkari, G. Draper-Gil, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of Tor traffic using time based features,” in Proc. Int. Conf. Information Systems Security and Privacy (ICISSP), 2017. [Online]. Available: https://doi.org/10.5220/0006105602530262 [27] M. Varol and A. Karakaya, “Explainable AI-based intrusion detection systems for IoT environments: A systematic literature review,” Sensors, vol. 26, no. 18, Art. no. 5744, 2026. [Online]. Available: https://doi.org/10.3390/s26185744 [28] G. P. Oise et al., “Attention-based intrusion detection using transformer networks on UNSW-NB15,” Scientific Reports, vol. 16, Art. no. 33862, 2026. [Online]. Available: https://doi.org/10.1038/s41598-026-65710-2 [29] M. Alauthman et al., “Generative adversarial networks for intrusion detection systems: A comprehensive survey of applications, challenges, and research directions,” Arabian Journal for Science and Engineering, vol. 51, pp. 179–203, 2026. [Online]. Available: https://doi.org/10.1007/s13369-026-11103-6 [30] M. Moustafa, N. Slay, and others, “The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 dataset and the comparison with the KDD99 dataset,” Information Security Journal: A Global Perspective, 2016. [Online]. Available: https://doi.org/10.1080/19393555.2015.1125974.

Copyright

Copyright © 2026 Monalika Devendra Kakde, Dr. Sushma V. Telrandhe, Prof. Priyadarshani S. Gotmare. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.