INTELLIGENT SYSTEMS FOR ADVANCED ANOMALY DETECTION IN MODERN CYBERSECURITY USING MACHINE LEARNING

Abstract

Machine learning (ML) models have become integral to improving the performance of cybersecurity systems, particularly in the deployment of Intrusion Detection Systems (IDS). Despite their effectiveness, recent research has revealed that these models are highly vulnerable to adversarial attacks. By introducing subtle perturbations into network traffic features, attackers can manipulate ML-based IDS to misclassify malicious activity as benign, thereby evading detection. This growing threat highlights the urgent need for robust defence mechanisms against adversarial manipulation. However, achieving adversarial robustness in cybersecurity applications presents several challenges. A key difficulty lies in balancing model resilience with computational efficiency, ensuring that enhanced security does not come at the cost of performance. Additionally, designing defence strategies that generalize well across a wide range of adversarial techniques remains a complex problem. Most existing defence approaches have been primarily developed for domains such as computer vision and are rarely validated on cybersecurity-specific datasets. Unlike visual or audio data, network traffic exhibits unique temporal patterns and structural characteristics, requiring tailored solutions. In this study, the NSL-KDD dataset is used to evaluate the proposed HyAD-F framework against two widely adopted gradient-based adversarial attack methods: Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD). The evaluation considers both adversarial and non-adversarial scenarios using three machine learning classifiers—Logistic Regression, Gradient Boosting Classifier, and Multi-Layer Perceptron. Results demonstrate that the integrated defence approach significantly improves adversarial accuracy against both FGSM and PGD attacks, while causing only minimal impact on standard intrusion detection performance. These findings emphasize the importance of rigorous security evaluation of IDS models before their deployment in real-world environments