Modern Networks, Security Threats, and the Role of Artificial Intelligence: A Review

Abstract

Networks now connect mobile users, cloud platforms, edge nodes and billions of small devices, and every new connection widens the area that attackers can reach. This paper reviews the present state of networking, the main security threats, and the ways artificial intelligence (AI) is being used both to manage networks and to defend them. It describes 5G and emerging 6G systems, software-defined and virtualized infrastructure, the Internet of Things (IoT) and zero trust architecture. It then examines current threats, from record-scale denial-of-service attacks to AI-assisted intrusion. The core of the paper covers AI applications in intrusion detection, traffic optimization, automated response and self-managing networks, followed by a critical look at the weaknesses of AI itself: adversarial manipulation, data poisoning, false alarms, privacy and limited explainability. Evidence from recent surveys, standards and industry reports indicates that AI can shorten detection and response times and reduce breach costs, but only when it is governed carefully and protected as a target in its own right.

Introduction

The text is a narrative review of Artificial Intelligence (AI) in modern computer network security and operations. It explains how modern networks have become more complex because of cloud computing, IoT, 5G/6G, edge computing, virtualization, and distributed services, and how AI can help detect, prevent, and respond to cyber threats.

Modern Network Environment

Traditional networks were designed around a protected internal network and a secure external boundary. This model is becoming less effective because modern infrastructure is distributed across:

• Cloud and data centers
• Edge computing environments
• IoT devices
• 5G and emerging 6G networks
• Software-defined and virtualized networks
• Remote users and services

The Zero Trust Architecture addresses this change by eliminating implicit trust and continuously verifying users, devices, and access requests.

Major Network Security Threats

The text identifies several important threats:

• DDoS attacks: Large-scale attacks can overwhelm network resources and occur too quickly for humans to respond manually.
• Ransomware: Attackers can gain access and encrypt or steal organizational data.
• Phishing and credential theft: Stolen passwords and deceptive messages are common entry points.
• Insider threats: Employees or other authorized users can intentionally or accidentally create security risks.
• IoT vulnerabilities: Poorly protected devices can become entry points or components of botnets.
• Cloud and supply-chain weaknesses: Misconfigured cloud services, excessive permissions, and vulnerable third-party software create additional risks.
• AI-enabled attacks: Attackers can use AI to automate reconnaissance, generate malicious code, create deceptive content, and coordinate attacks.

Applications of AI in Networks

AI is increasingly used in both network security and network management.

1. Intrusion and Anomaly Detection

Machine learning and deep learning can analyze network traffic to distinguish between normal and malicious behavior. Techniques include:

• Random forests and other supervised classifiers
• Convolutional neural networks
• Autoencoders
• Recurrent neural networks
• Transformers and other sequence models

Unlike traditional signature-based systems, learning-based approaches can potentially detect previously unseen attack patterns.

2. Traffic Prediction and Network Optimization

AI can forecast network traffic and assist with:

• Capacity planning
• Routing
• Spectrum management
• Energy optimization
• Network-slice resource allocation

Understanding normal traffic patterns also helps identify unusual network activity.

3. Automated Threat Response

AI can support Security Orchestration, Automation and Response (SOAR) by ranking alerts, correlating events, and recommending or executing actions such as:

• Isolating compromised devices
• Blocking malicious addresses
• Revoking access tokens
• Triggering predefined incident-response procedures

Automation is particularly important for attacks that develop or disappear within seconds.

4. Self-Healing and Intent-Based Networking

AI can allow networks to operate more autonomously. In intent-based networking, administrators specify high-level goals and the system translates them into network configurations. Self-healing networks can detect faults, diagnose problems, and automatically apply corrective actions.

Common AI Techniques

Risks and Limitations

The use of AI also introduces significant security and operational challenges.

• Adversarial attacks: Attackers can manipulate inputs to fool AI models.
• Data poisoning: Malicious training data can cause models to learn incorrect patterns.
• False positives: Excessive incorrect alerts can overwhelm security analysts and reduce trust in AI systems.
• Outdated training data: Models trained on old datasets may not perform well against current threats.
• Privacy concerns: Network traffic used for AI training can contain sensitive information.
• Federated-learning risks: Although federated learning reduces the need to share raw data, it remains vulnerable to poisoning, inference attacks, and differences between participating networks.
• LLM risks: AI agents may hallucinate, be manipulated, or receive too much control over live infrastructure.

Conclusion

Modern networks are larger, more distributed and more programmable than their predecessors, and the threats against them are growing in volume and speed. The evidence reviewed here indicates that AI is already useful in detecting intrusions, managing operations and automating response, and that organizations using it extensively in security have reported lower breach costs and shorter breach lifecycles [1]. The same evidence shows that AI is not a cure-all. Models can be fooled or poisoned, produce costly false alarms, depend on sensitive data and resist explanation, and autonomous agents with broad permissions create new ways to cause harm [13], [14], [15]. Several practical recommendations follow. Organizations should adopt zero trust principles as the architectural base [6]; use AI for detection and response where speed matters, with humans in control of high-impact actions; protect models and training data as security assets, following guidance such as NIST’s adversarial machine learning taxonomy [14]; establish clear governance for all AI use, including unsanctioned tools [1]; and begin planning the migration to quantum-safe cryptography [19]. Future research should focus on evaluation with realistic and current data, robust and explainable detection, safe limits on agent autonomy and privacy-preserving collaboration among networks. This review has limits. It is a narrative synthesis of selected recent sources, several of which are industry reports and preprints that have not all been through formal peer review, and the field changes quickly. Readers should treat the figures quoted here as snapshots from the cited dates.

References

[1] IBM, “IBM report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls,” IBM Newsroom (Cost of a Data Breach Report 2025, with Ponemon Institute), Jul. 30, 2025. [Online]. Available: https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls [2] Cloudforce One, “Cloudflare DDoS threat report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave,” Cloudflare Blog, Aug. 11, 2026. [Online]. Available: https://blog.cloudflare.com/ddos-threat-report-2026-h1/ [3] “Cloudflare says 1 Tbps DDoS attacks grew sixfold in the second quarter,” SiliconANGLE, Aug. 11, 2026. [Online]. Available: https://siliconangle.com/2026/08/11/cloudflare-says-1-tbps-ddos-attacks-grew-sixfold-second-quarter/ [4] I. W. A. J. Pawana, V. Abella, E. Aaron Miole, H. Park, and I. You, “AI-native security for 5G and 6G O-RAN: A survey of learning-based defense against false base stations, DDoS, and signaling storms,” Comput. Model. Eng. Sci., vol. 148, no. 3, p. 6, Sep. 2026, doi: 10.32604/cmes.2026.087445. [5] B. Barua et al., “Toward a unified security and privacy framework for AI-native 6G networks,” arXiv:2607.01019, Jul. 2026, doi: 10.48550/arXiv.2607.01019. [6] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero Trust Architecture,” NIST Special Publication 800-207, Aug. 2020, doi: 10.6028/NIST.SP.800-207. [7] B. Toulas, “DDoS attacks over 1 Tbps surged fivefold in the second quarter,” BleepingComputer, Aug. 11, 2026. [Online]. Available: https://www.bleepingcomputer.com/news/security/ddos-attacks-over-1-tbps-surged-fivefold-in-the-second-quarter/ [8] M. Xu et al., “Forewarned is forearmed: A survey on large language model-based agents in autonomous cyberattacks,” arXiv:2505.12786, 2025, doi: 10.48550/arXiv.2505.12786. [9] J. Liu et al., “Generative AI and federated learning for intrusion detection systems: A survey,” arXiv:2607.01305, Jul. 2026, doi: 10.48550/arXiv.2607.01305. [10] Z. Xu et al., “Deep learning-based intrusion detection systems: A survey,” arXiv:2504.07839, 2025, doi: 10.48550/arXiv.2504.07839. [11] J. Lansky et al., “Deep learning-based intrusion detection systems: A systematic review,” IEEE Access, vol. 9, pp. 101574–101599, 2021, doi: 10.1109/ACCESS.2021.3097247. [12] V. Vinay, “The evolution of agentic AI in cybersecurity: From single LLM reasoners to multi-agent systems and autonomous pipelines,” arXiv:2512.06659, 2025, doi: 10.48550/arXiv.2512.06659. [13] “When your AI assistant has the keys to production,” Help Net Security, May 20, 2026. [Online]. Available: https://www.helpnetsecurity.com/2026/05/20/agentic-ai-security-llm-research/ [14] National Institute of Standards and Technology, “Adversarial machine learning: A taxonomy and terminology of attacks and mitigations,” NIST AI 100-2e2025, Mar. 2025, doi: 10.6028/NIST.AI.100-2e2025. [15] R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in Proc. IEEE Symp. Security and Privacy, 2010, pp. 305–316. [16] U. A. Isma’ila, K. U. Danyaro, A. A. Muazu, and U. D. Maiwada, “Review on approaches of federated modeling in anomaly-based intrusion detection for IoT devices,” IEEE Access, vol. 12, pp. 30941–30961, 2024. [17] A. Vyas, P.-C. Lin, R.-H. Hwang, and M. Tripathi, “Privacy-preserving federated learning for intrusion detection in IoT environments: A survey,” IEEE Access, vol. 12, pp. 127018–127050, 2024, doi: 10.1109/ACCESS.2024.3454211. [18] K. Matthew and T. John-Dewole, “Federated learning–driven intrusion detection in cloud–IoT settings: A security-centric survey,” Lead City Univ. Postgraduate Multidisciplinary Serials, vol. 2025, no. 1, pp. 603–618, 2025. [19] National Institute of Standards and Technology, “Module-Lattice-Based Key-Encapsulation Mechanism Standard,” FIPS 203, Aug. 13, 2024, doi: 10.6028/NIST.FIPS.203; “Module-Lattice-Based Digital Signature Standard,” FIPS 204, doi: 10.6028/NIST.FIPS.204; “Stateless Hash-Based Digital Signature Standard,” FIPS 205, doi: 10.6028/NIST.FIPS.205.

Copyright

Copyright © 2026 Rajalakshmanan .. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.