An Integrated Machine Learning Framework for Adaptive Cybersecurity Threat Detection

Abstract

The rapid growth of digital technologies, cloud computing, Internet of Things (IoT), and interconnected networks has significantly increased the frequency and sophistication of cyber threats. Traditional cybersecurity solutions that rely on signature-based detection mechanisms are increasingly ineffective against advanced persistent threats (APTs), zero-day attacks, ransomware, and polymorphic malware. However, individual machine learning (ML) models have limitations, including high false-positive rates, limited adaptability and difficulty detecting previously unseen attacks. This paper proposes an Integrated Adaptive Cybersecurity Framework (IACF) that combines supervised learning (Random Forest, XGBoost, SVM), unsupervised anomaly detection (Isolation Forest, k-means, Autoencoder) and deep learning (CNN, LSTM) within a seven-layer architecture that also incorporates threat intelligence integration, concept-drift-based adaptive learning, automated response and explainable AI (SHAP, LIME). The framework was evaluated on four benchmark datasets; CIC-IDS2017, UNSW-NB15, NSL-KDD and CIC-DDoS2019 using accuracy, precision, recall, F1-score and false positive rate (FPR). Detection accuracy ranged from 98.87% (UNSW-NB15) to 99.85% (CIC-DDoS2019), with corresponding FPR between 0.12% and 0.42%. Under controlled drift-injection experiments, the framework recovered detection accuracy to between 97.6% and 98.9% after concept, feature and adversarial drift. Explainability evaluation with a small panel of security analysts (n = 15) indicated a 43.8% increase in reported trust and a 46% reduction in alert investigation time when SHAP/LIME explanations were provided, and the pipeline processed 1,000 packets in approximately 422 ms on the reported hardware configuration. The principal contribution of the study is the integration of supervised, unsupervised and deep-learning detection with concept-drift adaptation and explainability within a single closed-loop architecture, and an empirical demonstration of its performance on standard intrusion-detection benchmarks.