Network Attack Detection Using Machine Learning, Deep Learning, and Autonomous Defense Agents

Abstract

AI-driven cyberattacks represent major challenges to detect by classic security frameworks, which makes it important to employ intelligent and autonomous mechanisms. In this paper, we present a data-driven analysis of network attack detection and reduction using machine learning, deep learning, and an Autonomous Defense Agent (ADA) for real-time threat detection and response. Experiments are done on two benchmark datasets CIC-IoT 2023 and UNSW-NB15 datasets, representing network intrusion scenarios. We addressed the imbalance in the dataset CIC-IoT 2023 with a 1:41 benign-to-attack skewed ratio by applying the Synthetic Minority Over-sampling Technique (SMOTE) to the training set. For classification progress, we used four classical ML classifiers (Decision Tree, Random Forest, XGBoost, and KNN), and also an LSTM model. Furthermore, we designed an Autonomous Defense Agent (ADA) for real-time intrusion detection. The highest F1 achieved for Random Forest is 99.39% on CIC-IoT 2023 and 88.67% on UNSW-NB15. For XGBoost, the same accuracy was achieved with 12 times faster training speed. This makes it the preferred ADA backbone. LSTM outperforms on structured IoT traffic with F1=98.82%, but on the other hand, fails on heterogeneous traffic with F1=43.29%. This shows how data temporal characteristics affect model selection. The ADA achieves 99.94% precision on CIC-IoT 2023 with sub-1ms average response latency. The results provide a principled model selection criterion that prefers the classical ML methods for heterogeneous traffic and LSTM for temporally structured IoT traffic, and also provides an ADA design to validate real benchmark datasets.