Machine Learning Framework for Predicting Emerging Cyber Threats

Abstract

Modern cyber attacks increasingly involve adaptive adversaries, zero-day exploitation, polymorphic behavior, multi-stage campaigns, and weak signals distributed across heterogeneous security telemetry. Traditional signature-based intrusion detection systems are effective for known threats but provide limited capability for predicting emerging attacks before they fully materialize. This paper presents THREATPREDICT-AI, a machine learning framework for predicting emerging cyber threats through weak-signal anomaly detection, time-series threat forecasting, graph-based threat correlation, ensemble risk scor-ing, explainable prediction artifacts, audit logging, and Human-in-the-Loop analyst validation. The proposed framework ingests safe cyber telemetry such as SIEM logs, IDS alerts, endpoint events, firewall records, authentication logs, and cyber threat intelligence indicators. It converts raw events into event-level, window-level, temporal, and graph-level features. Anomaly risk, forecast risk, and graph risk are fused into a calibrated threat score and mapped to low, medium, or high risk levels. A Flask-based prototype was implemented with a SOC dashboard, role-based access control, synthetic event generation, prediction management, HITL review, configurable model settings, and audit logs. Experimental demonstration using 220 synthetic cyber events generated 59 prediction windows and detected a high-risk emerging threat window with a final score of 0.83. The results show that combining anomaly, temporal, and graph sig-nals improves proactive threat identification while explainability, auditability, and analyst governance improve operational trust.

Introduction

The paper proposes THREATPREDICT-AI, a predictive and governance-aware cybersecurity framework designed to identify emerging cyber threats before they become full-scale attacks. Modern cyberattacks are increasingly sophisticated, involving multiple stages such as reconnaissance, credential abuse, privilege escalation, lateral movement, command-and-control communication, and data exfiltration. Traditional intrusion detection systems (IDS) rely mainly on signature matching or standalone anomaly detection, making them ineffective against zero-day attacks, evolving threats, and complex multi-stage attack campaigns.

To overcome these limitations, THREATPREDICT-AI combines machine learning, time-series forecasting, graph analytics, explainable AI, and Human-in-the-Loop (HITL) validation into a unified framework. Rather than depending on a single detection model, the system analyzes cyber telemetry from multiple perspectives by evaluating behavioral anomalies, predicting future threat intensity, and identifying relationships among users, devices, IP addresses, assets, and security events through graph-based correlation.

The proposed architecture consists of five layers: data ingestion, preprocessing and feature engineering, analytical modeling, decision fusion with explainability, and governance with SOC presentation. It processes data from SIEM logs, IDS/IPS alerts, endpoint telemetry, firewall logs, authentication records, and cyber threat intelligence (CTI). The analytical layer computes three complementary risk measures: anomaly risk using Isolation Forest, forecast risk through time-series prediction of future threat intensity, and graph risk by analyzing structural relationships among cyber entities. These risk scores are combined using an ensemble model to generate a final threat prediction.

The framework emphasizes explainability and governance by recording the contribution of each analytical component to the final prediction, maintaining audit logs, and routing high-risk predictions to security analysts for review through a HITL workflow. This improves operational trust and ensures that automated decisions remain transparent and accountable.

The prototype was implemented as a Flask-based SOC application with role-based access control, dashboards, prediction management, audit logging, and analyst validation features. The system was evaluated using 220 synthetic cyber events, generating 59 prediction windows that included normal activity, failed logins, malware alerts, port scans, suspicious data transfers, and coordinated attack patterns. The framework successfully distinguished low-, medium-, and high-risk threat windows by combining anomaly detection, temporal forecasting, and graph correlation. High-risk windows were automatically forwarded for analyst validation, while the dashboard visualized threat intensity trends and risk distributions.

Conclusion

This paper presented THREATPREDICT-AI, a machine learning framework for predicting emerging cyber threats. The framework integrates heterogeneous cyber event ingestion, preprocessing, weak-signal anomaly detection, time-series forecasting, graph-based threat correlation, ensemble prediction, explainability, auditability, and Human-in-the-Loop validation. A Flask-based prototype demonstrated the end-to-end workflow using synthetic cyber events. The system generated 59 prediction windows from 220 events and detected a high-risk window with a final risk score of 0.83. The results show that integrated anomaly, temporal, and graph-based risk analysis can support proactive cyber defense while explainability, audit logging, and analyst validation improve operational trust. Future work includes evaluating the framework on larger real-world datasets, integrating streaming SIEM data, using LSTM or Transformer-based forecasting, applying graph neural networks, adding SHAP-based explanations, implementing adversarial robustness tests, and incorporating feedback-driven model adaptation from analyst decisions.

References

[1] R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in Proc. IEEE Symposium on Security and Privacy, 2010, pp. 305–316. [2] M. Ahmed, A. N. Mahmood, and J. Hu, “A survey of network anomaly detection techniques,” Journal of Network and Computer Applications, vol. 60, pp. 19–31, 2016. [3] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: A survey,” ACM Computing Surveys, vol. 41, no. 3, pp. 1–58, 2009. [4] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural Computation, vol. 9, no. 8, pp. 1735–1780, 1997. [5] G. E. P. Box, G. M. Jenkins, G. C. Reinsel, and G. M. Ljung, Time Series Analysis: Forecasting and Control, 5th ed. Wiley, 2015. [6] W. Wang and Z. Lu, “A survey on graph-based cyber security analytics,” IEEE Communications Surveys & Tutorials, vol. 23, no. 2, pp. 1232–1263, 2021. [7] MITRE Corporation, “MITRE ATT&CK framework,” 2024. [Online]. Available: https://attack.mitre.org [8] M. T. Ribeiro, S. Singh, and C. Guestrin, “Why should I trust you?: Explaining the predictions of any classifier,” in Proc. ACM SIGKDD, 2016, pp. 1135–1144. [9] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Advances in Neural Information Processing Systems, 2017. [10] S. Amershi, M. Cakmak, W. B. Knox, and T. Kulesza, “Power to the people: The role of humans in interactive machine learning,” AI Magazine, vol. 35, no. 4, pp. 105–120, 2014. [11] National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” 2023.

Copyright

Copyright © 2026 Vasavi Pandi, Mr. D. Bhagyaraj Yadav. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.