Modern cyberattacks have grown far more sophisticated, frequent, and fast-moving than the signature-based intrusion detection systems many organizations still rely on. This paper proposes CyberSentinel, a hybrid artificial intelligence framework for real-time cyber threat intelligence (CTI) that combines three complementary techniques into a single detection pipeline: a Convolutional Neural Network–Long Short-Term Memory (CNN-LSTM) module for network traffic anomaly detection, a Random Forest ensemble for structured log classification, and a transformer-based Named Entity Recognition (NER) model for extracting indicators of compromise from unstructured threat feeds. Rather than presenting new experimental results, this work grounds the proposed design in a structured review of previously published benchmark studies that employ the same component techniques and datasets — CICIDS2017, UNSW-NB15, and cyber threat intelligence text corpora. Results drawn from this literature show hybrid CNN/LSTM models reaching F1-scores in the upper 90s on CICIDS2017, Random Forest classifiers exceeding 97% F1 on UNSW-NB15, and fine-tuned BERT-based NER models achieving entity-level F1- scores in the low-to-mid 90s on cybersecurity text, with hybrid multi-modal systems generally outperforming single- modality baselines. These literature-derived benchmarks are used to motivate the proposed confidence-weighted fusion layer. CyberSentinel is presented as a fully specified proposed architecture; empirically validating it on the stated benchmark datasets is identified as the immediate next phase of this work.

Keywords- Cyber Threat Intelligence; Hybrid Artificial Intelligence; Intrusion Detection; Deep Learning; Natural Language Processing; MITRE ATT&CK; Anomaly Detection; Security Operations Center.

🔒 This is a subscription article

Full text is available to subscribers and institutional members. Please choose an option below to access it.

1. Sharafaldin I, Lashkari AH, Ghorbani AA. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp. 2018 Jan 22;1(2018):108-16.
2. Moustafa N, Slay J. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW- NB15 network data set). In2015 military communications and information systems conference (MilCIS) 2015 Nov 10 (pp. 1-6). Ieee.
3. Devlin J, Chang MW, Lee K, Toutanova K. Bert: Pre-training of deep bidirectional transformers for language understanding. InProceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers) 2019 Jun (pp. 4171- 4186).
4. Nakkiran P. A Discussion of'Adversarial Examples Are Not Bugs, They Are Features': Adversarial Examples are Just Bugs, Too. Distill. 2019 Aug 6;4(8):e00019-5.
5. Xin Y, Kong L, Liu Z, Chen Y, Li Y, Zhu H, Gao M, Hou H, Wang C. Machine learning and deep learning methods for cybersecurity. Ieee access. 2018 May 15;6:35365-81.
6. Vinayakumar R, Alazab M, Soman KP, Poornachandran P, Al-Nemrat A, Venkatraman S. Deep learning approach for intelligent intrusion detection system. IEEE access. 2019 Apr 3;7:41525-50.
7. Kasongo SM, Sun Y. A deep learning method with wrapper based feature extraction for wireless intrusion detection system. Computers & Security. 2020 May 1;92:101752,doi: 10.1016/j.cose.2020.101752.
8. Scarfone K, Mell P. Guide to intrusion detection and prevention systems (idps). NIST special publication. 2007 Feb 20;800(2007):94, https://doi.org/10.6028/NIST.SP.800-94.
9. Samtani S, Chai Y, Chen H. Linking exploits from the dark web to known vulnerabilities for proactive cyber threat intelligence: An attention-based deep structured semantic model. MIS quarterly. 2022 Jun 1;46(2):911-46.
10. More S, Idrissi M, Mahmoud H, Asyhari AT. Enhanced intrusion detection systems performance with UNSW-NB15 data analysis. Algorithms. 2024 Feb 1;17(2):64.
11. Mbow M, Koide H, Sakurai K. Handling class imbalance problem in intrusion detection system based on deep learning. International Journal of Networking and Computing. 2022;12(2):467- 92.
12. Park Y, You W. A pretrained language model for cyber threat intelligence. InProceedings of the 2023 conference on empirical methods in natural language processing: industry track 2023 Dec (pp. 113-122).

Modern cyberattacks have grown far more sophisticated, frequent, and fast-moving than the signature-based intrusion detection systems many organizations still rely on. This paper proposes CyberSentinel, a hybrid artificial intelligence framework for real-time cyber threat intelligence (CTI) that combines three complementary techniques into a single detection pipeline: a Convolutional Neural Network–Long Short-Term Memory (CNN-LSTM) module for network traffic anomaly detection, a Random Forest ensemble for structured log classification, and a transformer-based Named Entity Recognition (NER) model for extracting indicators of compromise from unstructured threat feeds. Rather than presenting new experimental results, this work grounds the proposed design in a structured review of previously published benchmark studies that employ the same component techniques and datasets — CICIDS2017, UNSW-NB15, and cyber threat intelligence text corpora. Results drawn from this literature show hybrid CNN/LSTM models reaching F1-scores in the upper 90s on CICIDS2017, Random Forest classifiers exceeding 97% F1 on UNSW-NB15, and fine-tuned BERT-based NER models achieving entity-level F1- scores in the low-to-mid 90s on cybersecurity text, with hybrid multi-modal systems generally outperforming single- modality baselines. These literature-derived benchmarks are used to motivate the proposed confidence-weighted fusion layer. CyberSentinel is presented as a fully specified proposed architecture; empirically validating it on the stated benchmark datasets is identified as the immediate next phase of this work.

Keywords- Cyber Threat Intelligence; Hybrid Artificial Intelligence; Intrusion Detection; Deep Learning; Natural Language Processing; MITRE ATT&CK; Anomaly Detection; Security Operations Center.

🔒 This is a subscription article

Full text is available to subscribers and institutional members. Please choose an option below to access it.

1. Sharafaldin I, Lashkari AH, Ghorbani AA. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp. 2018 Jan 22;1(2018):108-16.
2. Moustafa N, Slay J. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW- NB15 network data set). In2015 military communications and information systems conference (MilCIS) 2015 Nov 10 (pp. 1-6). Ieee.
3. Devlin J, Chang MW, Lee K, Toutanova K. Bert: Pre-training of deep bidirectional transformers for language understanding. InProceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers) 2019 Jun (pp. 4171- 4186).
4. Nakkiran P. A Discussion of'Adversarial Examples Are Not Bugs, They Are Features': Adversarial Examples are Just Bugs, Too. Distill. 2019 Aug 6;4(8):e00019-5.
5. Xin Y, Kong L, Liu Z, Chen Y, Li Y, Zhu H, Gao M, Hou H, Wang C. Machine learning and deep learning methods for cybersecurity. Ieee access. 2018 May 15;6:35365-81.
6. Vinayakumar R, Alazab M, Soman KP, Poornachandran P, Al-Nemrat A, Venkatraman S. Deep learning approach for intelligent intrusion detection system. IEEE access. 2019 Apr 3;7:41525-50.
7. Kasongo SM, Sun Y. A deep learning method with wrapper based feature extraction for wireless intrusion detection system. Computers & Security. 2020 May 1;92:101752,doi: 10.1016/j.cose.2020.101752.
8. Scarfone K, Mell P. Guide to intrusion detection and prevention systems (idps). NIST special publication. 2007 Feb 20;800(2007):94, https://doi.org/10.6028/NIST.SP.800-94.
9. Samtani S, Chai Y, Chen H. Linking exploits from the dark web to known vulnerabilities for proactive cyber threat intelligence: An attention-based deep structured semantic model. MIS quarterly. 2022 Jun 1;46(2):911-46.
10. More S, Idrissi M, Mahmoud H, Asyhari AT. Enhanced intrusion detection systems performance with UNSW-NB15 data analysis. Algorithms. 2024 Feb 1;17(2):64.
11. Mbow M, Koide H, Sakurai K. Handling class imbalance problem in intrusion detection system based on deep learning. International Journal of Networking and Computing. 2022;12(2):467- 92.
12. Park Y, You W. A pretrained language model for cyber threat intelligence. InProceedings of the 2023 conference on empirical methods in natural language processing: industry track 2023 Dec (pp. 113-122).