INTELLIGENT CYBER THREAT DETECTION AND ALERT SYSTEM

Abstract

This paper presents a hybrid, real-time cybersecurity threat detection platform for network flow analysis. The system combines a supervised Random Forest classifier, an unsupervised Isolation Forest anomaly detector, and five deterministic baseline rules to classify network flows across five attack categories: DoS, DDoS, Port Scanning, Web Attacks, and Infiltration. A rolling-window temporal analysis module detects burst and persistent attack campaigns across 5- minute, 1-hour, and 24-hour windows. VirusTotal Cyber Threat Intelligence (CTI) enrichment and a four-tier priority fusion engine (P0-P3) enable structured analyst triage. Evaluated on the ISCX CICIDS2017 benchmark, the Random Forest achieves 86.7% accuracy, 92.0% precision, 82.6% recall, and an F1-score of 87.1%. The platform is deployed as a FastAPI backend with a React dashboard, achieving sub-100 ms detection latency per flow.