AI-Driven Predictive Cyber Defense Framework Using Hybrid Learning Models

Abstract

The increasing complexity and frequency of cyber threats necessitate intelligent and proactive security mechanisms capable of accurately detecting and predicting network attacks. This study introduces an advanced AI-driven cyber attack prediction framework developed using the CICIDS2017 dataset, integrating Machine Learning, Deep Learning, Generative AI, and Explainable AI techniques. Comprehensive preprocessing is performed, including removal of missing and duplicate records, label encoding, data normalization, and dimensionality reduction through Principal Component Analysis to improve learning efficiency. Multiple machine learning classifiers, namely Decision Tree, Random Forest, Extra Trees Classifier, Logistic Regression, Gaussian Naïve Bayes, and a hybrid Voting Classifier combining Random Forest, LightGBM, and XGBoost, are evaluated alongside deep learning models such as DNN, CNN, LSTM, CNN–LSTM, and CNN–LSTM–GRU. Generative models, including Variational Autoencoder, Generative Adversarial Network, and DistilGPT2, are employed to generate synthetic attack patterns and strengthen anomaly representation. Experimental evaluation demonstrates that the Voting Classifier achieves the highest performance with 99.6% accuracy, while the LSTM model attains 99.3% accuracy, indicating robust detection across attack categories such as DoS, DDoS, PortScan, Bot, and Infiltration. Model interpretability is ensured using LIME and SHAP. The framework is deployed using Flask, enabling authentication, input processing, visualization, and classification of network traffic as benign or malicious.