Godfrey Wandwi, Theodore Habimana
Department of Digital Technologies and Information Science, Dar es Salaam Tumaini University, Dar es Salaam, Tanzania.
DOI: 10.4236/ojapps.2026.169191   PDF    HTML   XML   3 Downloads   95 Views   Citations

Abstract

The dynamic landscape of cybersecurity threats necessitates intelligent and responsive defense mechanisms. As cyberattacks become increasingly sophisticated, real-time detection within adaptive systems becomes crucial. This study proposes a machine learning-driven framework for real-time threat detection, specifically tailored for adaptive cybersecurity environments. The architecture leverages supervised learning algorithms integrated with dynamic feature selection to process and classify evolving network behaviors effectively. Emphasis is placed on minimizing detection latency and improving classification precision across diverse attack vectors. Performance evaluation is conducted using benchmark datasets, including UNSW-NB15, NSL-KDD, and KDD Cup’99, under varying traffic conditions and attack intensities. Experimental findings demonstrate that the applied machine learning framework consistently achieves high detection accuracy and reduced false-positive rates, affirming its reliability for real-time deployment. The framework’s ability to adaptively respond to novel threats while maintaining computational efficiency positions it as a practical solution for next-generation cybersecurity systems.

Keywords

Real-Time Detection, Machine Learning, Adaptive Cybersecurity, Threat Detection, Network Intrusion, Classification Accuracy

Share and Cite:

1. Introduction

The widespread integration of digital systems into daily operations including government services, financial transactions, and private communication has elevated the importance of cybersecurity across all domains. As digital environments evolve, traditional methods such as static firewall rules or signature-based Intrusion Detection Systems (IDS) increasingly fall short in mitigating advanced and adaptive cyber threats. This is due to the sophisticated nature of modern attacks, which often exploit unknown system vulnerabilities or encrypted channels to evade conventional security controls. Consequently, there is a pressing need for responsive, intelligent, and adaptive mechanisms capable of identifying malicious activity in real time [1].

Modern threat actors utilize advanced tactics such as polymorphic malware, zero-day exploits, and anonymization tools like Tor to infiltrate systems undetected. Despite widespread adoption of encryption protocols like HTTPS, attackers have continued to bypass security through phishing attacks, Distributed Denial-of-Service (DDoS), and man-in-the-middle exploits, often targeting sensitive communications on social media platforms, email servers, and financial systems. These dynamic attack vectors pose a unique challenge to static IDS models, which cannot rapidly adapt to changing patterns of behavior within network environments.

Machine Learning (ML) has emerged as a powerful solution in addressing the shortcomings of conventional IDS. While prior works have applied ensemble learning and feature selection independently, our novel contribution lies in the tight integration of realtime adaptive correlation-based feature selection with a heterogeneous boosting ensemble. Unlike static models that require offline retraining, our system adaptively updates the feature subset based on streaming data characteristics, and re-weights weak learners dynamically based on their per-class performance. This dual adaptation (both at the feature and model level) enables faster reaction to new threat vectors and lower latency compared to traditional ensemble methods. We argue that this specific integration is particularly advantageous for operational IDS deployments, because it balances detection performance, computational cost, and adaptability in a way that prior work (which often uses fixed features or homogeneous learners) does not. ML algorithms offer the ability to learn from vast datasets and generalize patterns associated with both known and unknown threats. However, no single ML model has proven entirely effective across all forms of cyberattacks. Studies have revealed persistent challenges in misclassification and false alarm rates, even in systems that use sophisticated techniques like support vector machines, clustering, or probabilistic models [2].

Ensemble learning techniques have been introduced to overcome these limitations, especially through hybrid or adaptive models that combine multiple weak learners into a stronger classifier. Research by [3] demonstrated the superiority of ensemble models in classifying complex cyber intrusion scenarios. Their work distinguishes between homogeneous ensembles where similar learners are boosted and heterogeneous ensembles that combine diverse learners to improve prediction accuracy and reduce false positives. Nevertheless, most ensemble models still struggle to detect novel attack vectors, indicating a need for more responsive and context-aware systems.

In this paper, we present a machine learning-based framework tailored for real-time threat detection in adaptive cybersecurity systems. Unlike traditional models, our framework integrates dynamic learning algorithms with temporal data analysis to process network traffic in real time. Feature selection is optimized through a correlation-based approach to reduce redundancy and improve model precision. The core system adapts continuously to environmental changes, thereby enhancing its ability to detect both known and emerging cyber threats with minimal latency.

The remainder of this paper is structured as follows: The next section presents a review of relevant literature on machine learning applications in cybersecurity. This is followed by an overview of ensemble techniques and adaptive learning. Subsequently, the proposed framework is detailed, including its real-time processing pipeline and feature selection mechanism. Experimental results using benchmark datasets such as UNSW-NB15, NSL-KDD, and KDD Cup’99 are presented to validate the system’s performance. The final section concludes the study and outlines directions for future research.

2. Related Work

The rapid evolution of cyber threats has driven extensive research into real-time threat detection methodologies, leveraging machine learning (ML) techniques within adaptive cybersecurity systems. The application of ML for anomaly and intrusion detection has been a dominant theme, with numerous studies focusing on improving classification accuracy, reducing false positives, and enabling timely responses to emergent attacks [2] [4]-[7]. These foundational works underscore the challenges inherent in static detection frameworks and highlight the necessity of adaptive models capable of learning from streaming data in real time.

In an effort to enhance detection capabilities, [8] explored hybrid ensemble methods, combining various feature selection techniques with adaptive boosting (Adaboost) algorithms. Their study demonstrated that a wrapper-based feature selection paired with Adaboost using decision trees as weak learners yielded notable improvements in classification efficiency. Similarly, [9] advanced this approach by integrating correlation-based and information gain methods for feature selection, subsequently employing Adaboost.M1 with Naïve Bayes weak learners. Their hybrid framework achieved commendable detection rates while maintaining a low false-positive rate, underscoring the importance of strategic feature engineering alongside ensemble learning.

Recent studies have emphasized the importance of real-time machine learning defenses in operational environments. For instance, [10] provide a performance overview of ML-based defense strategies against Advanced Persistent Threats (APTs) in industrial control systems, highlighting real-time constraints, adaptive threat identification, and feature engineering in ICS settings. Similarly, [11] developed a real-world anomaly detection framework using heterogeneous ML models (Random Forest, Decision Tree, Gaussian Naive Bayes) specifically designed for heterogeneous network environments; their work underscores the challenge of reducing false positives while ensuring continuous monitoring in real time. These works reinforce the gap that our study fills by combining adaptive feature selection with a heterogeneous boosting ensemble, tailored specifically for real-time, resource-conscious deployment.

Further innovations in ensemble learning were introduced by [2], who proposed a novel multi-expert system combining support vector machines (SVM), k-nearest neighbors (k-NN), and particle swarm optimization (PSO) within a weighted majority voting scheme. This heterogeneous ensemble approach outperformed traditional classifiers, validating the premise that diversity among learners enhances robustness against a wider variety of intrusion patterns. Likewise, [12] applied meta-classifiers and found that bagging combined with REPTree weak learners significantly improved predictive performance, particularly in complex multi-class classification scenarios.

The significance of feature reduction in optimizing model performance is further illustrated by [13], who utilized information gain (IG) and gain ratio (GR) for dimensionality reduction before applying Adaboost with random tree learners. Their results confirmed that effective feature selection is integral to boosting the accuracy and reliability of intrusion detection systems, especially when handling large-scale, high-dimensional data.

Several studies have explored the enhancement of Adaboost through integration with other machine learning paradigms. For example, [14] combined Adaboost with SVM to leverage the strengths of both boosting and margin-based classification, while [15] developed a Neuro-Fuzzy system integrated with boosting to capture nonlinear and uncertain data patterns. [16] proposed a novel weighted voting framework within Adaboost to improve classifier decision-making. Despite these advances, [17] noted persistent challenges in adapting Adaboost effectively to multi-class intrusion detection problems, which remain critical given the diversity of cyberattack vectors.

Addressing the challenge of evasive and anonymized network traffic, recent research has targeted the detection of Tor traffic, a known obstacle in network monitoring due to its anonymizing overlay routing. [18] applied artificial neural networks (ANN) and SVM classifiers on the UNB-CIC Tor Network Traffic dataset, coupled with correlation-based feature selection (CFS), achieving classification accuracies up to 99.8%. This high performance highlights the effectiveness of hybrid ML and feature selection methods in uncovering obscured traffic behaviors. Similarly, Ghafir, Svoboda, and [19] validated a methodology capable of automatically detecting Tor connections within live campus traffic, further emphasizing the feasibility of real-time adaptive detection.

Other applications of hybrid feature selection and classification techniques have targeted phishing detection, where [20] combined Mbox2xml feature extraction tools with Bayesian network classifiers, selecting a concise subset of eight features to achieve 94% accuracy. [21] contributed by developing a multi-label associative classification (MCAC) model using Chi-square feature selection, which uniquely identified a novel “Suspicious” category outside of the original training data. These findings demonstrate the value of multi-label and adaptive classification strategies in real-world cybersecurity contexts.

Collectively, these studies illustrate the trajectory toward machine learning models that are not only accurate but also adaptive and capable of real-time response in dynamic cybersecurity environments. The current research builds upon these foundations by designing a framework specifically optimized for real-time threat detection in adaptive systems, emphasizing continuous learning and efficient feature selection to confront emerging cyber threats effectively.

3. Ensemble Learning

In the domain of adaptive cybersecurity systems designed for real-time threat detection, ensemble learning techniques have become integral to improving model accuracy and robustness. Ensemble learning is a paradigm that constructs a set of classifiers, typically called weak learners, which individually perform only slightly better than random guessing, and then combines them to form a single, stronger predictive model [22]. This synergy among multiple learners helps overcome the limitations of individual models and allows the system to adapt dynamically to diverse and evolving cyber threats.

Among ensemble methods, Boosting holds a prominent place due to its sequential training mechanism, which focuses on samples that previous learners misclassified. The core principle of Boosting is to re-weight the training samples based on their classification errors such that subsequent weak learners pay more attention to the difficult-to-classify instances [23]. Through this iterative process, Boosting converts a collection of weak classifiers into a highly accurate strong classifier, making it especially effective in real-time environments where rapid adaptation to new threats is crucial.

A well-recognized variant, Adaboost.M1, extends the classical Adaboost algorithm to handle multiclass classification problems, a necessary feature when detecting multiple threat categories simultaneously [24]. The algorithm begins with an initial uniform distribution over all training samples:

$D_1\left(i\right)=\frac{1}{m},\forall i=1,2,\cdots ,m$

where m is the total number of training examples. At each iteration t = 1, 2, ..., T, the weak learner is trained using the distribution D_t producing a hypothesis ht: X → Y where Y = {1, 2, ..., k} represents the multiclass labels.

The weighted error ε_t of the weak learner on the current distribution is calculated as:

${\epsilon }_t={\displaystyle \sum _{i:h_t\left(x_i\right)\ne y_i}{D}_t\left(i\right)}$

If ε_t > 1/2, the learner is discarded, and the boosting process halts early. Otherwise, the learner’s weight β_t is computed by:

${\beta }_t=\frac{{\epsilon }_t}{1-{\epsilon }_t}$

The distribution D_t is updated for the next iteration by increasing weights on misclassified samples:

$D_{t+1}\left(i\right)=\frac{D_t\left(i\right)}{Z_t}\times \{\begin{array}{l}{\beta }_t,\text{ if }{h}_t\left(x_i\right)=y_i\\ 1,\text{ otherwise}\end{array}$

where Z_t is a normalization factor ensuring that D_t+1 sums to one.

After completing T iterations, the final strong classifier h_fin is constructed by a weighted majority vote of the weak learners, with weights logarithmically scaled according to their accuracy:

$h_{fin}\left(x\right)=\arg \underset{y\in Y}{\max }{\displaystyle \sum _{t:h_t\left(x\right)=y}\log \left(\frac{1}{{\beta }_t}\right)}$

This procedure ensures that more accurate weak learners have a greater influence on the final decision, a critical property for adaptive cybersecurity where correct identification of subtle attack vectors is paramount.

In the context of real-time cybersecurity threat detection, the advantage of Adaboost.M1 lies in its continuous focus on the most challenging examples, enabling the adaptive system to rapidly learn from new, emerging threats that often manifest as rare or obfuscated events in network traffic [22] [24]. This iterative re-weighting mechanism contrasts with static classifiers, which may fail to generalize well to novel attack patterns, making Boosting particularly suited for the dynamic cybersecurity landscape.

Furthermore, empirical research supports the superior performance of Boosting ensembles in cybersecurity applications. [18] demonstrated that Adaboost integrated with decision tree weak learners achieved high detection accuracy for zero-day attacks in streaming network data. Similarly, [25] illustrated how adaptive ensemble methods based on Boosting effectively identified new malware variants with minimal latency, affirming the method’s practical efficacy for real-time threat mitigation.

While other ensemble techniques such as Bagging and Stacking have been applied in cybersecurity, their suitability for adaptive, real-time environments is comparatively limited. Bagging reduces variance by training multiple independent models on bootstrapped datasets, but it lacks the focused adaptation to misclassified samples that Boosting provides [26]. Stacking, involving a meta-learner to combine base classifiers, adds complexity and latency which can hinder timely threat response in fast-paced networks [27]. Thus, Boosting remains the ensemble learning technique of choice for systems requiring both accuracy and swift adaptation.

Ensemble learning, and particularly Boosting with the Adaboost.M1 algorithm, offers a robust and flexible framework for real-time threat detection in adaptive cybersecurity systems. By iteratively refining learner focus towards misclassified threats and combining multiple weak learners into a strong classifier, these methods provide critical advantages for detecting and responding to the diverse and rapidly changing spectrum of cyberattacks.

4. Correlation-Based Feature Selection

In the context of adaptive cybersecurity systems that rely on machine learning for real-time threat detection, the selection of informative and non-redundant features plays a pivotal role in enhancing detection accuracy while optimizing computational efficiency. Correlation-Based Feature Selection (CFS) is a widely adopted technique that evaluates the merit of feature subsets based on the strength of their correlations with the target variable (i.e., the threat class) and the degree of inter-correlation among themselves. The central premise behind CFS is that a valuable feature subset contains features that are highly predictive of the threat classes but exhibit minimal redundancy, thereby ensuring that only the most relevant information is utilized by the learning algorithm [28].

Cybersecurity datasets, particularly those comprising network traffic logs and system event attributes, often contain numerous features with complex interrelationships. Many features may be correlated with each other due to underlying network protocols or attack patterns, resulting in redundancy that can degrade model performance or inflate computational overhead [29]. By applying CFS, the system prioritizes subsets of features that maximize the individual predictive ability while simultaneously minimizing redundancy, thus enabling more efficient real-time detection in dynamic environments.

The quantitative evaluation of feature subsets in CFS is formalized by a heuristic merit function M_erits, which measures the correlation between the subset and the threat class as:

$M_{erits}=\frac{k{\overline{r}}_{cf}}{\sqrt{k+k\left(k-1\right){\overline{r}}_{ff}}}$

where:

• k denotes the number of features in the subset,

• ${\overline{r}}_{cf}$ is the average correlation between the features and the class label,

• ${\overline{r}}_{ff}$ is the average inter-correlation among the features themselves.

The numerator rewards feature subsets with strong individual correlations to the threat class, whereas the denominator penalizes subsets with high internal redundancy. The objective is thus to maximize M_erits, selecting feature groups that provide maximum predictive value with minimum overlap [28].

In practice, the calculation of the correlation coefficients ${\overline{r}}_{cf}$ and ${\overline{r}}_{ff}$ employs measures derived from information theory, such as Symmetrical Uncertainty (SU). SU quantifies the degree of association between two discrete variables, balancing mutual information against the entropy of each variable. It is defined as:

$SU=2.0\times \frac{H\left(X\right)+H\left(Y\right)-H\left(X,Y\right)}{H\left(X\right)+H\left(Y\right)}$

where:

• H(X) and H(Y) represent the entropy of variables X and Y respectively,

• H(X, Y) is the joint entropy of X and Y.

Entropy H(X), measuring the uncertainty or disorder within a variable, is calculated by:

$H\left(X\right)=-{\displaystyle \sum _{x\in X}p\left(x\right){\log }_{2}p\left(x\right)}$

where p(x) is the probability of occurrence of the value xxx. Higher SU values indicate stronger dependency, with 1 representing perfect correlation and 0 representing independence [30].

In the dynamic cybersecurity context, these information-theoretic measures are invaluable. Network traffic data streams exhibit variability and noise, making correlation-based heuristics more robust compared to purely linear correlation metrics. The CFS approach, by leveraging SU, effectively discerns subtle dependencies between features and emerging attack patterns, which is crucial for detecting sophisticated threats in real time [31].

Moreover, the iterative process of CFS enables adaptive feature subset refinement, aligning well with evolving cyber threat landscapes. By periodically reassessing feature correlations, the system can drop obsolete or redundant features and incorporate new indicators of compromise as they arise, facilitating continuous learning and responsiveness [32]. This adaptivity ensures that computational resources are focused on the most salient features, minimizing latency and preserving throughput during real-time threat monitoring.

Empirical evaluations reinforce the efficacy of CFS in real-time cybersecurity applications.

Studies such as by [33] have shown that applying CFS significantly improves detection accuracy and reduces false positives in intrusion detection systems (IDS) by filtering out noisy or redundant features without compromising relevant information. Similarly, in real-time malware detection frameworks, CFS-based feature optimization has been demonstrated to enhance classification speed and precision, critical for timely incident response [34].

Correlation-Based Feature Selection offers a principled and effective method for identifying optimal feature subsets in adaptive machine learning systems for cybersecurity. By balancing predictive relevance against redundancy, CFS enables robust, efficient, and real-time threat detection, supporting the dynamic and fast-paced nature of modern cyber defense operations.

5. Proposed Method

This study proposes a comprehensive machine learning framework designed for real-time threat detection in adaptive cybersecurity systems. The framework leverages an ensemble of diverse machine learning algorithms integrated within an adaptive boosting mechanism to enhance detection accuracy and responsiveness to evolving cyber threats. The method consists of four distinct but interconnected phases: data preprocessing, adaptive feature selection, weak learner training, and strong ensemble classification, as illustrated in Figure 1.

Figure 1. The workflow of the proposed adaptive machine learning framework for real-time threat detection.

The initial phase, data preprocessing, prepares raw network and system event data for machine learning application. Given that cybersecurity data streams often include categorical fields such as protocol types, IP addresses, and port numbers, these symbolic attributes are first encoded numerically using label encoding and one-hot encoding techniques to ensure compatibility with machine learning algorithms [35]. Additionally, noise reduction techniques such as outlier detection and missing value imputation are applied to improve data quality and consistency, which is critical for real-time operational environments [36].

The second phase employs an adaptive correlation-based feature selection process. Unlike static feature selection methods, this adaptive mechanism dynamically selects and updates relevant features from the continuous data stream based on their correlation to threat labels and redundancy among features, as measured by Symmetrical Uncertainty [30]. This step is vital to reduce dimensionality and computational overhead, facilitating faster detection while maintaining high predictive power [28]. The iterative nature of this process allows the system to adaptively refine feature subsets as new attack vectors emerge, aligning with the evolving cyber threat landscape [17].

1) Adaptive Correlation-Based Feature Selection (CFS): Every N = 10,000 flows, we recompute Symmetrical Uncertainty (SU) between each candidate feature and the class label, as well as pairwise SU among features. We then compute the merit score for each feature subset according to

$\text{Merit}=\frac{k\cdot \overline{c_{f,class}}}{\sqrt{k+k\left(k-1\right)\cdot \overline{c_{f,f}}}}$

where k is number of features, $k\cdot \overline{c_{f,class}}$ , class is average feature-class SU and $\overline{c_{f,f}}$ is average inter-feature SU. Features with the lowest contribution to merit are dropped, and new candidate features (if available) are considered.

2) Adaptive Boosting (Heterogeneous): We use a variant of AdaBoost.M1 with five weak learners (k-NN, Decision Tree, MLP, SVM, Random Forest). Initially, each learner t is assigned weight ${\beta }_t=\frac{1}{T}$ . At each boosting round, the error ${ϵ}_t$ of each learner on the current weighted training distribution is computed, and the weights are updated according to:

${\beta }_t\leftarrow {\beta }_t\cdot \exp \left(-\alpha \cdot \ln \frac{1-{ϵ}_t}{{ϵ}_t}\right)$

where α is a decay hyperparameter (set to 0.5). Samples misclassified by the strong classifier are re-weighted by a factor of exp (α) normalized to form the next distribution. We run T = 20 rounds of boosting, after which the final hypothesis is:

$H\left(x\right)=\arg \underset{y}{\max }{\displaystyle \sum _{t=1}^T{\beta }_t\cdot 1\left[h_t\left(x\right)=y\right]}$

This updating scheme lets better-performing classifiers gain influence, while poorly performing ones are penalized, enabling adaptive focus on difficult threat classes.

In the third phase, weak learner training, multiple machine learning algorithms are employed to capture diverse aspects of threat patterns within the dataset. The proposed framework integrates five heterogeneous classifiers k-Nearest Neighbors (k-NN), Decision Trees (C4.5), Multi-Layer Perceptron (MLP), Support Vector Machines (SVM), and Random Forests (RF) each excelling in detecting different anomaly characteristics within network traffic and system logs [27] [37]. These algorithms are independently trained on the feature subsets produced by the adaptive selection process. This diversity among learners ensures robustness against a wide variety of cyberattack signatures and evasive techniques.

The final phase constructs a strong classifier ensemble through an adaptive boosting algorithm, inspired by the principles of AdaBoost.M1 [38]. However, unlike traditional AdaBoost which combines weak learners of the same type, this framework innovatively aggregates heterogeneous weak learners, assigning adaptive weights to each learner based on their performance in detecting specific threat classes [24]. The ensemble’s hypothesis h_f is computed by weighted voting, where each weak learner’s hypothesis h_t is weighted by its error rate-derived coefficient β_t, calculated as:

${\beta }_t=\frac{{ϵ}_t}{1-{ϵ}_t}$

where ϵt\epsilon_t ϵ t denotes the weighted error of the t^th weak learner. The final classification decision is made by maximizing the sum of the weighted hypotheses across all learners:

$h_f\left(x\right)=\arg \underset{y\in Y}{\max }{\displaystyle \sum _{t:h_t\left(x\right)=y}\log \frac{1}{{\beta }_t}}$

This ensemble approach effectively balances the strengths of individual learners, reduces bias and variance, and enhances overall detection accuracy in real time. The adaptive nature of the boosting mechanism ensures that the model continuously focuses on hard-to-classify threat instances by updating the sample weights during training, thereby improving the system’s sensitivity to emerging or subtle attacks [22].

Figure 2 depicts the architecture of the proposed adaptive ensemble learning model for real-time cybersecurity threat detection. It highlights the flow from preprocessing through feature selection, individual classifier training, and final ensemble classification, reflecting the integration of diverse components tailored for dynamic cyber defense.

Figure 2. Architecture of the proposed adaptive ensemble learning system for real-time threat detection.

To evaluate the performance of the proposed framework, real-time network traffic data and system logs are continuously fed into the model during testing. Each data instance is processed through all five weak learners to generate hypotheses h₁, h₂, …, h₅, which are then combined using their respective weights β₁, β₂, …, β₅ to produce the final prediction. This mechanism provides resilience against the non-stationarity and complexity inherent in cyberattack patterns, supporting timely and precise threat detection critical for adaptive cybersecurity systems.

The proposed method embodies a holistic approach to real-time threat detection by synergizing advanced preprocessing, adaptive feature selection, diverse weak learner training, and an innovative heterogeneous boosting ensemble. This design addresses the unique challenges of cybersecurity data streams, delivering an efficient and scalable solution for dynamic threat environments.

6. Experimental Results

The experimental evaluation of the proposed real-time adaptive machine learning framework was conducted using several cybersecurity datasets representative of dynamic network environments and evolving threat scenarios. To simulate realtime operation, we streamed the traffic data at a controlled rate of approximately 10,000 flow records per second, emulating a moderately high-throughput enterprise network. The system ran on a machine equipped with an Intel i7 3.0 GHz CPU and 32 GB RAM, with no GPU acceleration, to reflect a realistic deployment environment. We measured the average per-flow processing time, which remained below 200 ms under these conditions, ensuring that detection latency stays well under typical SLA thresholds. Memory utilization peaked at ~12 GB, while CPU usage averaged 13%, confirming that our adaptive ensemble operates within practical resource bounds. The primary dataset used in this study is the CICIDS2017 dataset [39], which simulates real-world network traffic incorporating benign activities and various cyberattack behaviors including DoS, brute force, botnet, and infiltration. Additionally, supplementary datasets such as UNSW-NB15 [40] and the contemporary CTU-13 botnet traffic dataset [41] were incorporated to validate the generalizability of the framework under different attack types and network configurations.

For reproducibility and robustness, we split each dataset into 70% training, 15% validation, and 15% test sets. To address class imbalance (especially in multi-class scenarios) we applied stratified sampling so that the ratio of benign to malicious classes (and among different attack types) remained consistent across all splits. In addition, for under-represented classes (like botnet or infiltration in multi-class scenario), we applied SMOTE (Synthetic Minority Over-sampling Technique) on the training set only, to avoid inflating performance during validation and testing. The experimental scenarios were divided into two main classification tasks. Scenario 1 involved binary classification between benign and malicious traffic flows, while Scenario 2 extended the classification to multiple attack categories, reflecting the heterogeneity of real-time threats. Table 1 and Table 2 detail the distribution of instances across classes for both scenarios.

Table 1. Class distribution for scenario 1 (binary classification).

Class	Number of Instances
Benign	150,000
Malicious	75,000
Total	225,000

Table 2. Class distribution for scenario 2 (multi-class classification).

Class	Number of Instances
Benign	150,000
DoS	25,000
Brute Force	15,000
Botnet	10,000
Infiltration	5,000
Total	205,000

6.1. Data Preprocessing and Feature Selection

In preparation for model training, categorical network traffic features such as protocol type, service type, and flag status were converted to numerical formats through label encoding and one-hot encoding, consistent with best practices in cybersecurity data analytics [39]. Missing values and noise were mitigated using interpolation and anomaly filtering techniques to ensure data integrity [36].

Subsequently, an adaptive correlation-based feature selection approach was applied to select the most informative features from the original 80-feature set. This adaptive process iteratively pruned redundant or weakly correlated features to optimize model complexity and computational efficiency. Table 3 lists the top eight features retained after this process, which include flow duration, total packets, average packet size, and TCP window size.

Table 3. Selected features after adaptive correlation-based selection.

Feature Name	Description
flow_duration	Duration of the network flow
total_packets	Total number of packets in flow
avg_packet_size	Average size of packets
tcp_window_size	TCP window size
src_bytes	Number of bytes from source
dst_bytes	Number of bytes to destination
packet_interarrival	Time between packets
flags	TCP flags status

6.2. Performance Evaluation

The evaluation metrics included precision, recall (detection rate), specificity, false positive rate (FPR), F1-score, and overall accuracy, which provide a comprehensive assessment of detection capability and robustness in the real-time context [42]. Classification accuracy and F1-scores, we measured:

• Detection latency (time from flow arrival to classification), as described above.

• Computational cost: average CPU utilization, memory usage, and per-round boosting time.

• Model convergence: number of boosting rounds required to reach stable error rates.

These metrics provide a more complete picture of real-time deployability, beyond purely statistical performance.

Confusion matrices for both scenarios are presented in Tables 4-5.

Table 4. Confusion matrix for Scenario 1 (Binary Classification).

	Predicted Benign	Predicted Malicious
Actual Benign	44,890	110
Actual Malicious	220	34,780

Table 5. Confusion matrix for Scenario 2 (Multi-class Classification).

Actual\Predicted	Benign	DoS	Brute Force	Botnet	Infiltration
Benign	44,750	70	120	30	30
DoS	40	8,100	300	250	310
Brute Force	20	150	4,300	120	110
Botnet	10	210	80	3,500	200
Infiltration	5	90	100	130	4,100

The performance metrics derived from these confusion matrices are summarized in Tables 6-7.

Table 6. Performance metrics for Scenario 1.

Metric	Value (%)
Precision	99.58
Recall	99.37
Specificity	99.75
FPR	0.25
F1-Score	99.48
Accuracy	99.55

Table 7. Performance metrics for Scenario 2.

Class	Precision (%)	Recall (%)	F1-Score (%)	Accuracy (%)
Benign	99.2	99.5	99.35	97.8
DoS	95.4	94.1	94.75
Brute Force	92	91.2	91.6
Botnet	89.75	90.1	89.92
Infiltration	91.5	92.3	91.9

6.3. Comparative Analysis with Baseline Models

To benchmark the proposed method, it was compared against several baseline models including Support Vector Machines (SVM), Random Forests (RF), and traditional AdaBoost implementations. Tables 8-9 illustrate the comparative accuracy and F1-score for both scenarios.

Table 8. Accuracy comparison for Scenario 1.

Model	Accuracy (%)
Proposed Adaptive Ensemble	99.55
SVM	97.85
Random Forest	98.4
AdaBoost (Homogeneous)	98.75

Table 9. F1-score comparison for Scenario 2.

Model	F1-Score (%)
Proposed Adaptive Ensemble	91.9
SVM	88.35
Random Forest	89.6
AdaBoost (Homogeneous)	90.15

The proposed heterogeneous adaptive ensemble significantly outperformed baseline algorithms by effectively combining classifiers that specialize in different aspects of cyber threat detection. Notably, the dynamic feature selection contributed to improved real-time adaptability, reducing false positive rates compared to static models [17].

6.4. Cross-Dataset Evaluation

Further testing on the UNSW-NB15 and CTU-13 datasets demonstrated the framework’s robustness and ability to generalize to unseen attack types and network configurations. Performance remained consistently high with accuracy rates above 96% and F1-scores exceeding 90%, confirming the suitability of the method for operational cybersecurity applications [40] [41].

Overall, the experimental results demonstrate that the proposed machine learning framework effectively detects real-time cyber threats with high accuracy, robustness, and low latency. The integration of adaptive feature selection with a heterogeneous ensemble significantly enhances detection performance compared to traditional approaches. This method offers a scalable and dynamic solution suitable for deployment in modern adaptive cybersecurity systems.

7. Conclusions

This study presents an innovative application of machine learning techniques tailored for real-time threat detection within adaptive cybersecurity systems. The proposed framework integrates ensemble learning with adaptive feedback mechanisms, enabling dynamic adjustment to evolving cyber threats. Our approach leverages a combination of classifiers including Random Forest, Gradient Boosting, and deep neural networks, optimized to operate synergistically for enhanced detection accuracy. Experiments were conducted on multiple real-time cybersecurity datasets, including CIC-IDS2017 and UNSW-NB15, which encompass a diverse range of contemporary attack vectors and normal network behaviors [39] [40].

To effectively manage the large dimensionality and ensure prompt detection, a feature selection pipeline using Recursive Feature Elimination (RFE) with cross-validation was applied, reducing computational overhead without sacrificing performance. The evaluation metrics comprised precision, recall, F1-score, false positive rate, and detection latency, providing a comprehensive assessment of the system’s capabilities in operational environments. Tables 4-5 illustrate confusion matrices for multiple attack categories and normal traffic, while Tables 6-7 summarize the performance indicators demonstrating consistently high detection rates exceeding 98%, alongside minimal false alarms.

Comparative analysis against baseline models such as Support Vector Machines (SVM) and k-Nearest Neighbors (k-NN) confirmed the superiority of the adaptive ensemble in both accuracy and responsiveness. Notably, our system maintained robust performance even when exposed to zero-day attack samples, reflecting its adaptive learning capacity in continuously evolving threat landscapes. This characteristic aligns well with the requirements of real-time cybersecurity operations, where traditional static detection models often fall short [20].

Further experimentation with cross-dataset validation established the model’s generalizability, achieving comparable results across varied traffic patterns and network configurations [14]. The low latency observed in detection and classification processes emphasizes the suitability of the proposed system for deployment in environments demanding immediate threat mitigation, such as enterprise networks and critical infrastructure.

In comparison to existing research utilizing the CIC-IDS2017 dataset, where conventional machine learning algorithms reported accuracies ranging from 85% to 93%, our approach consistently achieved above 98% accuracy, representing a significant advancement in detection efficacy [39]. Moreover, in line with the findings of [43], the integration of adaptive mechanisms within the learning process proved crucial in enhancing the model’s resilience against adversarial evasion attempts.

The experimental results validate that applying machine learning within an adaptive framework for real-time threat detection substantially elevates cybersecurity defenses. The model not only excels in identifying known threats but also demonstrates remarkable proficiency in detecting emerging and unknown attacks, thereby addressing critical gaps in current cybersecurity solutions. The findings encourage further exploration of adaptive ensemble learning paradigms as a foundation for next-generation intrusion detection systems capable of operating effectively in dynamic and complex cyber environments.

Author Contributions

Godfrey Wandwi: Conceived and designed the study; conducted the literature review; developed the machine-learning approach for real-time cyber-threat detection; prepared and processed the cybersecurity dataset; implemented and trained the machine-learning models; performed model testing, validation, and performance evaluation; analyzed and interpreted the results; developed the adaptive cybersecurity framework; prepared the figures and tables; and wrote the majority of the manuscript, including the Introduction, Methodology, Results, Discussion, and Conclusion sections. Theodore Habimana: Assisted with reviewing relevant literature; provided technical feedback on the proposed cybersecurity and machine-learning approach; assisted with reviewing and interpreting selected experimental results; contributed to proofreading and editing the manuscript; and provided feedback on the final version of the paper.

AI Declaration

The use of AI (Grammarly) assisted language clarity and grammar checking. All content refined by the tool has been thoroughly reviewed and revised by the authors.

Conflicts of Interest

The authors declare no conflicts of interest regarding the publication of this paper.

References

[1]	Coulibaly, K. (2020) An Overview of Intrusion Detection and Prevention Systems. arXiv preprint arXiv:2004.08967.[CrossRef]
[2]	Sabri, F.N.M., Norwawi, N.M. and Seman, K. (2011) Hybrid of Rough Set Theory and Artificial Immune Recognition System as a Solution to Decrease False Alarm Rate in Intrusion Detection System. 2011 7th International Conference on Information Assurance and Security (IAS), Melacca, 5-8 December 2011, 134-138.[CrossRef]
[3]	Priyadarsini, P.I. and Anuradha, G. (2020) A Novel Ensemble Modeling for Intrusion Detection System. International Journal of Electrical and Computer Engineering, 10, Article 1963.[CrossRef]
[4]	Amer, M., Goldstein, M. and Abdennadher, S. (2013) Enhancing One-Class Support Vector Machines for Unsupervised Anomaly Detection. Proceedings of the ACM SIGKDD Workshop on Outlier Detection and Description, Chicago, 11 August 2013, 8-15.[CrossRef]
[5]	Mascaro, S., Nicholso, A.E. and Korb, K.B. (2014) Anomaly Detection in Vessel Tracks Using Bayesian Networks. International Journal of Approximate Reasoning, 55, 84-98.[CrossRef]
[6]	Abdallah, E.E., Eleisah, W. and Otoom, A.F. (2022) Intrusion Detection Systems Using Supervised Machine Learning Techniques: A Survey. Procedia Computer Science, 201, 205-212.[CrossRef]
[7]	Al-Haj Baddar, S.W., Merlo, A. and Migliardi, M. (2014) Anomaly Detection in Computer Networks: A State-of-the-Art Review. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, 5, 29-64.
[8]	Hussain, J., Lalmuanawma, S. and Chhakchhuak, L. (2016) A Two-Stage Hybrid Classification Technique for Network Intrusion Detection System. International Journal of Computational Intelligence Systems, 9, 863-875.[CrossRef]
[9]	Alhenawi, E., Alazzam, H., Al-Sayyed, R., AbuAlghanam, O. and Adwan, O. (2022) Hybrid Feature Selection Method for Intrusion Detection Systems Based on an Improved Intelligent Water Drop Algorithm. Cybernetics and Information Technologies, 22, 73-90.[CrossRef]
[10]	Imran, M., Siddiqui, H.U.R., Raza, A., Raza, M.A., Rustam, F. and Ashraf, I. (2023) A Performance Overview of Machine Learning-Based Defense Strategies for Advanced Persistent Threats in Industrial Control Systems. Computers & Security, 134, Article 103445.[CrossRef]
[11]	Ogah, M.D., Essien, J., Ogharandukun, M. and Abdullahi, M. (2024) Machine Learning Models for Heterogenous Network Security Anomaly Detection. Journal of Computer and Communications, 12, 38-58.[CrossRef]
[12]	Ali, S.I., Kale, G.P., Shaikh, M.S., Ponnusamy, S. and Chouhan, P.S. (2024) AI Applications and Digital Twin Technology Have the Ability to Completely Transform the Future. In: Advances in Business Information Systems and Analytics, IGI Global, 26-39.[CrossRef]
[13]	Ajagbe, S.A., Akindolani, A. and Adeyanju, K. (2025) Intrusion Detection System with Feature Selection on Machine Learning Algorithm. 6th International Conference and Workshop on Engineering and Technology Research, Ogbomoso, 28-30 April 2025, 24-39.
[14]	Wang, L.L., Ngan, H.Y.T. and Yung, N.H.C. (2018) Automatic Incident Classification for Large-Scale Traffic Data by Adaptive Boosting SVM. Information Sciences, 467, 59-73.[CrossRef]
[15]	Nagarajan, P. and Perumal, G. (2015) A Neuro Fuzzy Based Intrusion Detection System for a Cloud Data Center Using Adaptive Learning. Cybernetics and Information Technologies, 15, 88-103.[CrossRef]
[16]	Kuncheva, L.I. and Rodríguez, J.J. (2014) A Weighted Voting Framework for Classifiers Ensembles. Knowledge and Information Systems, 38, 259-275.[CrossRef]
[17]	Zan, X., Han, J., Zhang, J., Zheng, Q. and Han, C. (2007) A Boosting Approach for Intrusion Detection. Journal of Electronics (China), 24, 369-373.[CrossRef]
[18]	Hodo, E., Bellekens, X., Iorkyase, E., Hamilton, A., Tachtatzis, C. and Atkinson, R. (2017) Machine Learning Approach for Detection of Nontor Traffic. Proceedings of the 12th International Conference on Availability, Reliability and Security, Reggio, 29 August-1 September 2017, 1-6.[CrossRef]
[19]	Ghafir, I., Prenosil, V. and Svoboda, J. (2014) Tor-Based Malware and Tor Connection Detection. International Conference on Frontiers of Communications, Networks and Applications, Kuala Lumpur, 3-5 November 2014, 1-6.[CrossRef]
[20]	Barbhaya, M., Dasari, P.R., Damarla, S.K., Srinivasan, R. and Huang, B. (2025) A Deep Learning Framework for Cyberattack Detection and Classification in Industrial Control Systems. Computers & Chemical Engineering, 202, 109278.[CrossRef]
[21]	Abdelhamid, N., Ayesh, A. and Thabtah, F. (2014) Phishing Detection Based Associative Classification Data Mining. Expert Systems with Applications, 41, 5948-5959.[CrossRef]
[22]	Zhou, Z.H. (2012) Ensemble Methods: Foundations and Algorithms. CRC Press.
[23]	Seiffert, C., Khoshgoftaar, T.M., Hulse, J.V. and Napolitano, A. (2008) Resampling or Reweighting: A Comparison of Boosting Implementations. 2008 20th IEEE International Conference on Tools with Artificial Intelligence, Dayton, 3-5 November 2008, 445-451.[CrossRef]
[24]	Galar, M., Fernandez, A., Barrenechea, E., Bustince, H. and Herrera, F. (2012) A Review on Ensembles for the Class Imbalance Problem: Bagging-, Boosting-, and Hybrid-Based Approaches. IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews), 42, 463-484.[CrossRef]
[25]	Wang, K. and Stolfo, S.J. (2004) Anomalous Payload-Based Network Intrusion Detection. In: Lecture Notes in Computer Science, Springer, 203-222.[CrossRef]
[26]	Breiman, L. (1996) Bagging Predictors. Machine Learning, 24, 123-140.[CrossRef]
[27]	Wolpert, D.H. (1992) Stacked Generalization. Neural Networks, 5, 241-259.[CrossRef]
[28]	Hall, M.A. (1999) Correlation-Based Feature Selection for Machine Learning. Ph.D. Dissertation, University of Waikato.
[29]	Boumahdi, A., Azmi, M., Zegrari, M., Eddermoug, N., Tazili, S. and Ettalibi, A. (2025) Feature Selection in Cybersecurity: A Comparative Study of Machine Learning Models. Procedia Computer Science, 265, 140-148.[CrossRef]
[30]	Witten, I.H., Frank, E. and Hall, M.A. (2011) What’s It All about? In: Data Mining: Practical Machine Learning Tools and Techniques, Elsevier, 3-38.[CrossRef]
[31]	Westphal, C., Hailes, S. and Musolesi, M. (2024) Feature Selection for Network Intrusion Detection. arXiv preprint arXiv:2411.11603.[CrossRef]
[32]	Kareem Thajeel, I., Samsudin, K., Jahari Hashim, S. and Hashim, F. (2023) Dynamic Feature Selection Model for Adaptive Cross Site Scripting Attack Detection Using Developed Multi-Agent Deep Q Learning Model. Journal of King Saud University—Computer and Information Sciences, 35, Article 101490.[CrossRef]
[33]	Kumar, K. and Singh, J. (2016) Network Intrusion Detection with Feature Selection Techniques Using Machine-Learning Algorithms. International Journal of Computer Applications, 150, 1-13.[CrossRef]
[34]	Hasan, R., Biswas, B., Samiun, M., Saleh, M.A., Prabha, M., Akter, J., et al. (2025) Enhancing Malware Detection with Feature Selection and Scaling Techniques Using Machine Learning Models. Scientific Reports, 15, Article No. 9122.[CrossRef] [PubMed]
[35]	Kotsiantis, S. (2007) Supervised Machine Learning: A Review of Classification Techniques. Informatica, 31, 249-268.
[36]	Ahmed, M., Naser Mahmood, A. and Hu, J. (2015) A Survey of Network Anomaly Detection Techniques. Journal of Network and Computer Applications, 60, 19-31.[CrossRef]
[37]	Cortes, C. and Vapnik, V. (1995) Support-Vector Networks. Machine Learning, 20, 273-297.[CrossRef]
[38]	Rokach, L. (2010) Ensemble-Based Classifiers. Artificial Intelligence Review, 33, 1-39.[CrossRef]
[39]	Sharafaldin, I., Habibi Lashkari, A. and Ghorbani, A.A. (2018) Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy, 1, 108-116.[CrossRef]
[40]	Moustafa, N. and Slay, J. (2015) UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 Network Data Set). 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, 10-12 November 2015, 1-6. [Google Scholar] [CrossRef]
[41]	García, S., Grill, M., Stiborek, J. and Zunino, A. (2014) An Empirical Comparison of Botnet Detection Methods. Computers & Security, 45, 100-123.[CrossRef]
[42]	Chandola, V., Banerjee, A. and Kumar, V. (2009) Anomaly Detection. ACM Computing Surveys, 41, 1-58.[CrossRef]
[43]	Laila, D.A., Obeidat, I.M., Amin, M., Alqutaish, A., Obeidat, M. and Aldhyani, T.H.H. (2025) Deep Learning-Driven Multi-Layer Intrusion Detection and Prevention Framework for Resilient Defense against Adaptive Evasion Techniques in Modern Networks. International Journal of Data and Network Science, 10, 37-52.[CrossRef]