Real-Time Threat Detection and Incident Response Using ML

With the rise in complex and evolving cyber threats, the need for intelligent, responsive, and resilient intrusion detection systems has become paramount. Traditional security infrastructures often fall short in detecting real-time anomalies and responding swiftly to attacks. To address these critical challenges, we propose a Network-based Intrusion Detection System (NIDS) that integrates machine learning algorithms for real-time monitoring and protection of IT infrastructures. Our system is trained using the NF-UQ-NIDSv2 dataset, enabling the detection and classification of multiple threat vectors such as port scans, SSH brute force attempts, file integrity violations, and Denial-of-Service (DoS) attacks. Our approach employs a Random Forest model to perform highaccuracy anomaly detection through continuous analysis of system logs and network traffic. Upon identifying a threat, the system autonomously blocks the malicious IP and generates detailed incident alerts for administrators. In addition to threat detection, the system provides robust defense mechanisms, including file integrity monitoring, real-time alert notifications, and user behavior analysis. This ensures not only rapid response but also comprehensive threat management across different layers of the system. Moreover, we implemented the architecture using Python with a modular structure to support scalability and adaptability across varied network environments. Emphasis is placed on automation and minimal manual intervention, ensuring the system can evolve by learning from newly encountered attack patterns. Through this, we aim to significantly enhance the cybersecurity landscape by providing a dynamic, self-learning, and efficient intrusion detection solution capable of defending against modern cyber threats. The inclusion of simulated scenarios for attacks and defenses-such as port scanning, DoS attacks, and file tampering-demonstrates the practical effectiveness and realworld relevance of our proposed framework.