The widespread integration of digital systems into daily operations including government services, financial transactions, and private communication has elevated the importance of cybersecurity across all domains. As digital environments evolve, traditional methods such as static firewall rules or signature-based Intrusion Detection Systems (IDS) increasingly fall short in mitigating advanced and adaptive cyber threats. This is due to the sophisticated nature of modern attacks, which often exploit unknown system vulnerabilities or encrypted channels to evade conventional security controls. Consequently, there is a pressing need for responsive, intelligent, and adaptive mechanisms capable of identifying malicious activity in real time [1].

Modern threat actors utilize advanced tactics such as polymorphic malware, zero-day exploits, and anonymization tools like Tor to infiltrate systems undetected. Despite widespread adoption of encryption protocols like HTTPS, attackers have continued to bypass security through phishing attacks, Distributed Denial-of-Service (DDoS), and man-in-the-middle exploits, often targeting sensitive communications on social media platforms, email servers, and financial systems. These dynamic attack vectors pose a unique challenge to static IDS models, which cannot rapidly adapt to changing patterns of behavior within network environments.

Machine Learning (ML) has emerged as a powerful solution in addressing the shortcomings of conventional IDS. While prior works have applied ensemble learning and feature selection independently, our novel contribution lies in the tight integration of realtime adaptive correlation-based feature selection with a heterogeneous boosting ensemble. Unlike static models that require offline retraining, our system adaptively updates the feature subset based on streaming data characteristics, and re-weights weak learners dynamically based on their per-class performance. This dual adaptation (both at the feature and model level) enables faster reaction to new threat vectors and lower latency compared to traditional ensemble methods. We argue that this specific integration is particularly advantageous for operational IDS deployments, because it balances detection performance, computational cost, and adaptability in a way that prior work (which often uses fixed features or homogeneous learners) does not. ML algorithms offer the ability to learn from vast datasets and generalize patterns associated with both known and unknown threats. However, no single ML model has proven entirely effective across all forms of cyberattacks. Studies have revealed persistent challenges in misclassification and false alarm rates, even in systems that use sophisticated techniques like support vector machines, clustering, or probabilistic models [2].

Ensemble learning techniques have been introduced to overcome these limitations, especially through hybrid or adaptive models that combine multiple weak learners into a stronger classifier. Research by [3] demonstrated the superiority of ensemble models in classifying complex cyber intrusion scenarios. Their work distinguishes between homogeneous ensembles where similar learners are boosted and heterogeneous ensembles that combine diverse learners to improve prediction accuracy and reduce false positives. Nevertheless, most ensemble models still struggle to detect novel attack vectors, indicating a need for more responsive and context-aware systems.

In this paper, we present a machine learning-based framework tailored for real-time threat detection in adaptive cybersecurity systems. Unlike traditional models, our framework integrates dynamic learning algorithms with temporal data analysis to process network traffic in real time. Feature selection is optimized through a correlation-based approach to reduce redundancy and improve model precision. The core system adapts continuously to environmental changes, thereby enhancing its ability to detect both known and emerging cyber threats with minimal latency.

The remainder of this paper is structured as follows: The next section presents a review of relevant literature on machine learning applications in cybersecurity. This is followed by an overview of ensemble techniques and adaptive learning. Subsequently, the proposed framework is detailed, including its real-time processing pipeline and feature selection mechanism. Experimental results using benchmark datasets such as UNSW-NB15, NSL-KDD, and KDD Cup’99 are presented to validate the system’s performance. The final section concludes the study and outlines directions for future research.

The rapid evolution of cyber threats has driven extensive research into real-time threat detection methodologies, leveraging machine learning (ML) techniques within adaptive cybersecurity systems. The application of ML for anomaly and intrusion detection has been a dominant theme, with numerous studies focusing on improving classification accuracy, reducing false positives, and enabling timely responses to emergent attacks [2][4]-[7]. These foundational works underscore the challenges inherent in static detection frameworks and highlight the necessity of adaptive models capable of learning from streaming data in real time.

In an effort to enhance detection capabilities, [8] explored hybrid ensemble methods, combining various feature selection techniques with adaptive boosting (Adaboost) algorithms. Their study demonstrated that a wrapper-based feature selection paired with Adaboost using decision trees as weak learners yielded notable improvements in classification efficiency. Similarly, [9] advanced this approach by integrating correlation-based and information gain methods for feature selection, subsequently employing Adaboost.M1 with Naïve Bayes weak learners. Their hybrid framework achieved commendable detection rates while maintaining a low false-positive rate, underscoring the importance of strategic feature engineering alongside ensemble learning.

Recent studies have emphasized the importance of real-time machine learning defenses in operational environments. For instance, [10] provide a performance overview of ML-based defense strategies against Advanced Persistent Threats (APTs) in industrial control systems, highlighting real-time constraints, adaptive threat identification, and feature engineering in ICS settings. Similarly, [11] developed a real-world anomaly detection framework using heterogeneous ML models (Random Forest, Decision Tree, Gaussian Naive Bayes) specifically designed for heterogeneous network environments; their work underscores the challenge of reducing false positives while ensuring continuous monitoring in real time. These works reinforce the gap that our study fills by combining adaptive feature selection with a heterogeneous boosting ensemble, tailored specifically for real-time, resource-conscious deployment.

Further innovations in ensemble learning were introduced by [2], who proposed a novel multi-expert system combining support vector machines (SVM), k-nearest neighbors (k-NN), and particle swarm optimization (PSO) within a weighted majority voting scheme. This heterogeneous ensemble approach outperformed traditional classifiers, validating the premise that diversity among learners enhances robustness against a wider variety of intrusion patterns. Likewise, [12] applied meta-classifiers and found that bagging combined with REPTree weak learners significantly improved predictive performance, particularly in complex multi-class classification scenarios.

The significance of feature reduction in optimizing model performance is further illustrated by [13], who utilized information gain (IG) and gain ratio (GR) for dimensionality reduction before applying Adaboost with random tree learners. Their results confirmed that effective feature selection is integral to boosting the accuracy and reliability of intrusion detection systems, especially when handling large-scale, high-dimensional data.

Several studies have explored the enhancement of Adaboost through integration with other machine learning paradigms. For example, [14] combined Adaboost with SVM to leverage the strengths of both boosting and margin-based classification, while [15] developed a Neuro-Fuzzy system integrated with boosting to capture nonlinear and uncertain data patterns. [16] proposed a novel weighted voting framework within Adaboost to improve classifier decision-making. Despite these advances, [17] noted persistent challenges in adapting Adaboost effectively to multi-class intrusion detection problems, which remain critical given the diversity of cyberattack vectors.

Addressing the challenge of evasive and anonymized network traffic, recent research has targeted the detection of Tor traffic, a known obstacle in network monitoring due to its anonymizing overlay routing. [18] applied artificial neural networks (ANN) and SVM classifiers on the UNB-CIC Tor Network Traffic dataset, coupled with correlation-based feature selection (CFS), achieving classification accuracies up to 99.8%. This high performance highlights the effectiveness of hybrid ML and feature selection methods in uncovering obscured traffic behaviors. Similarly, Ghafir, Svoboda, and [19] validated a methodology capable of automatically detecting Tor connections within live campus traffic, further emphasizing the feasibility of real-time adaptive detection.

Other applications of hybrid feature selection and classification techniques have targeted phishing detection, where [20] combined Mbox2xml feature extraction tools with Bayesian network classifiers, selecting a concise subset of eight features to achieve 94% accuracy. [21] contributed by developing a multi-label associative classification (MCAC) model using Chi-square feature selection, which uniquely identified a novel “Suspicious” category outside of the original training data. These findings demonstrate the value of multi-label and adaptive classification strategies in real-world cybersecurity contexts.

Collectively, these studies illustrate the trajectory toward machine learning models that are not only accurate but also adaptive and capable of real-time response in dynamic cybersecurity environments. The current research builds upon these foundations by designing a framework specifically optimized for real-time threat detection in adaptive systems, emphasizing continuous learning and efficient feature selection to confront emerging cyber threats effectively.

In the domain of adaptive cybersecurity systems designed for real-time threat detection, ensemble learning techniques have become integral to improving model accuracy and robustness. Ensemble learning is a paradigm that constructs a set of classifiers, typically called weak learners, which individually perform only slightly better than random guessing, and then combines them to form a single, stronger predictive model [22]. This synergy among multiple learners helps overcome the limitations of individual models and allows the system to adapt dynamically to diverse and evolving cyber threats.

Among ensemble methods, Boosting holds a prominent place due to its sequential training mechanism, which focuses on samples that previous learners misclassified. The core principle of Boosting is to re-weight the training samples based on their classification errors such that subsequent weak learners pay more attention to the difficult-to-classify instances [23]. Through this iterative process, Boosting converts a collection of weak classifiers into a highly accurate strong classifier, making it especially effective in real-time environments where rapid adaptation to new threats is crucial.

A well-recognized variant, Adaboost.M1, extends the classical Adaboost algorithm to handle multiclass classification problems, a necessary feature when detecting multiple threat categories simultaneously [24]. The algorithm begins with an initial uniform distribution over all training samples:

where m is the total number of training examples. At each iteration t = 1, 2, ..., T, the weak learner is trained using the distribution D_t producing a hypothesis ht: X → Y where Y = {1, 2, ..., k} represents the multiclass labels.

The weighted error ε_t of the weak learner on the current distribution is calculated as:

If ε_t > 1/2, the learner is discarded, and the boosting process halts early. Otherwise, the learner’s weight β_t is computed by:

The distribution D_t is updated for the next iteration by increasing weights on misclassified samples:

where Z_t is a normalization factor ensuring that D_t+1 sums to one.

After completing T iterations, the final strong classifier h_fin is constructed by a weighted majority vote of the weak learners, with weights logarithmically scaled according to their accuracy:

This procedure ensures that more accurate weak learners have a greater influence on the final decision, a critical property for adaptive cybersecurity where correct identification of subtle attack vectors is paramount.

In the context of real-time cybersecurity threat detection, the advantage of Adaboost.M1 lies in its continuous focus on the most challenging examples, enabling the adaptive system to rapidly learn from new, emerging threats that often manifest as rare or obfuscated events in network traffic [22][24]. This iterative re-weighting mechanism contrasts with static classifiers, which may fail to generalize well to novel attack patterns, making Boosting particularly suited for the dynamic cybersecurity landscape.

Furthermore, empirical research supports the superior performance of Boosting ensembles in cybersecurity applications. [18] demonstrated that Adaboost integrated with decision tree weak learners achieved high detection accuracy for zero-day attacks in streaming network data. Similarly, [25] illustrated how adaptive ensemble methods based on Boosting effectively identified new malware variants with minimal latency, affirming the method’s practical efficacy for real-time threat mitigation.

While other ensemble techniques such as Bagging and Stacking have been applied in cybersecurity, their suitability for adaptive, real-time environments is comparatively limited. Bagging reduces variance by training multiple independent models on bootstrapped datasets, but it lacks the focused adaptation to misclassified samples that Boosting provides [26]. Stacking, involving a meta-learner to combine base classifiers, adds complexity and latency which can hinder timely threat response in fast-paced networks [27]. Thus, Boosting remains the ensemble learning technique of choice for systems requiring both accuracy and swift adaptation.

Ensemble learning, and particularly Boosting with the Adaboost.M1 algorithm, offers a robust and flexible framework for real-time threat detection in adaptive cybersecurity systems. By iteratively refining learner focus towards misclassified threats and combining multiple weak learners into a strong classifier, these methods provide critical advantages for detecting and responding to the diverse and rapidly changing spectrum of cyberattacks.

In the context of adaptive cybersecurity systems that rely on machine learning for real-time threat detection, the selection of informative and non-redundant features plays a pivotal role in enhancing detection accuracy while optimizing computational efficiency. Correlation-Based Feature Selection (CFS) is a widely adopted technique that evaluates the merit of feature subsets based on the strength of their correlations with the target variable (i.e., the threat class) and the degree of inter-correlation among themselves. The central premise behind CFS is that a valuable feature subset contains features that are highly predictive of the threat classes but exhibit minimal redundancy, thereby ensuring that only the most relevant information is utilized by the learning algorithm [28].

Cybersecurity datasets, particularly those comprising network traffic logs and system event attributes, often contain numerous features with complex interrelationships. Many features may be correlated with each other due to underlying network protocols or attack patterns, resulting in redundancy that can degrade model performance or inflate computational overhead [29]. By applying CFS, the system prioritizes subsets of features that maximize the individual predictive ability while simultaneously minimizing redundancy, thus enabling more efficient real-time detection in dynamic environments.

The quantitative evaluation of feature subsets in CFS is formalized by a heuristic merit function M_erits, which measures the correlation between the subset and the threat class as:

where:

k denotes the number of features in the subset, r ¯ c f is the average correlation between the features and the class label, r ¯ f f is the average inter-correlation among the features themselves.

The numerator rewards feature subsets with strong individual correlations to the threat class, whereas the denominator penalizes subsets with high internal redundancy. The objective is thus to maximize M_erits, selecting feature groups that provide maximum predictive value with minimum overlap [28].

In practice, the calculation of the correlation coefficients r ¯ c f and r ¯ f f employs measures derived from information theory, such as Symmetrical Uncertainty (SU). SU quantifies the degree of association between two discrete variables, balancing mutual information against the entropy of each variable. It is defined as:

where:

H(X) and H(Y) represent the entropy of variables X and Y respectively,H(X, Y) is the joint entropy of X and Y.

Entropy H(X), measuring the uncertainty or disorder within a variable, is calculated by:

where p(x) is the probability of occurrence of the value xxx. Higher SU values indicate stronger dependency, with 1 representing perfect correlation and 0 representing independence [30].

In the dynamic cybersecurity context, these information-theoretic measures are invaluable. Network traffic data streams exhibit variability and noise, making correlation-based heuristics more robust compared to purely linear correlation metrics. The CFS approach, by leveraging SU, effectively discerns subtle dependencies between features and emerging attack patterns, which is crucial for detecting sophisticated threats in real time [31].

Moreover, the iterative process of CFS enables adaptive feature subset refinement, aligning well with evolving cyber threat landscapes. By periodically reassessing feature correlations, the system can drop obsolete or redundant features and incorporate new indicators of compromise as they arise, facilitating continuous learning and responsiveness [32]. This adaptivity ensures that computational resources are focused on the most salient features, minimizing latency and preserving throughput during real-time threat monitoring.

Empirical evaluations reinforce the efficacy of CFS in real-time cybersecurity applications.

Studies such as by [33] have shown that applying CFS significantly improves detection accuracy and reduces false positives in intrusion detection systems (IDS) by filtering out noisy or redundant features without compromising relevant information. Similarly, in real-time malware detection frameworks, CFS-based feature optimization has been demonstrated to enhance classification speed and precision, critical for timely incident response [34].

Correlation-Based Feature Selection offers a principled and effective method for identifying optimal feature subsets in adaptive machine learning systems for cybersecurity. By balancing predictive relevance against redundancy, CFS enables robust, efficient, and real-time threat detection, supporting the dynamic and fast-paced nature of modern cyber defense operations.

This study proposes a comprehensive machine learning framework designed for real-time threat detection in adaptive cybersecurity systems. The framework leverages an ensemble of diverse machine learning algorithms integrated within an adaptive boosting mechanism to enhance detection accuracy and responsiveness to evolving cyber threats. The method consists of four distinct but interconnected phases: data preprocessing, adaptive feature selection, weak learner training, and strong ensemble classification, as illustrated in Figure 1.

Figure 1. The workflow of the proposed adaptive machine learning framework for real-time threat detection.

The initial phase, data preprocessing, prepares raw network and system event data for machine learning application. Given that cybersecurity data streams often include categorical fields such as protocol types, IP addresses, and port numbers, these symbolic attributes are first encoded numerically using label encoding and one-hot encoding techniques to ensure compatibility with machine learning algorithms [35]. Additionally, noise reduction techniques such as outlier detection and missing value imputation are applied to improve data quality and consistency, which is critical for real-time operational environments [36].

The second phase employs an adaptive correlation-based feature selection process. Unlike static feature selection methods, this adaptive mechanism dynamically selects and updates relevant features from the continuous data stream based on their correlation to threat labels and redundancy among features, as measured by Symmetrical Uncertainty [30]. This step is vital to reduce dimensionality and computational overhead, facilitating faster detection while maintaining high predictive power [28]. The iterative nature of this process allows the system to adaptively refine feature subsets as new attack vectors emerge, aligning with the evolving cyber threat landscape [17].

1) Adaptive Correlation-Based Feature Selection (CFS): Every N = 10,000 flows, we recompute Symmetrical Uncertainty (SU) between each candidate feature and the class label, as well as pairwise SU among features. We then compute the merit score for each feature subset according to

where k is number of features, k ⋅ c f , c l a s s ¯ , class is average feature-class SU and c f , f ¯ is average inter-feature SU. Features with the lowest contribution to merit are dropped, and new candidate features (if available) are considered.

2) Adaptive Boosting (Heterogeneous): We use a variant of AdaBoost.M1 with five weak learners (k-NN, Decision Tree, MLP, SVM, Random Forest). Initially, each learner t is assigned weight β t = 1 T . At each boosting round, the error ϵ t of each learner on the current weighted training distribution is computed, and the weights are updated according to:

where α is a decay hyperparameter (set to 0.5). Samples misclassified by the strong classifier are re-weighted by a factor of exp (α) normalized to form the next distribution. We run T = 20 rounds of boosting, after which the final hypothesis is:

This updating scheme lets better-performing classifiers gain influence, while poorly performing ones are penalized, enabling adaptive focus on difficult threat classes.

In the third phase, weak learner training, multiple machine learning algorithms are employed to capture diverse aspects of threat patterns within the dataset. The proposed framework integrates five heterogeneous classifiers k-Nearest Neighbors (k-NN), Decision Trees (C4.5), Multi-Layer Perceptron (MLP), Support Vector Machines (SVM), and Random Forests (RF) each excelling in detecting different anomaly characteristics within network traffic and system logs [27][37]. These algorithms are independently trained on the feature subsets produced by the adaptive selection process. This diversity among learners ensures robustness against a wide variety of cyberattack signatures and evasive techniques.

The final phase constructs a strong classifier ensemble through an adaptive boosting algorithm, inspired by the principles of AdaBoost.M1 [38]. However, unlike traditional AdaBoost which combines weak learners of the same type, this framework innovatively aggregates heterogeneous weak learners, assigning adaptive weights to each learner based on their performance in detecting specific threat classes [24]. The ensemble’s hypothesis h_f is computed by weighted voting, where each weak learner’s hypothesis h_t is weighted by its error rate-derived coefficient β_t, calculated as:

where ϵt\epsilon_t ϵ t denotes the weighted error of the t^th weak learner. The final classification decision is made by maximizing the sum of the weighted hypotheses across all learners:

This ensemble approach effectively balances the strengths of individual learners, reduces bias and variance, and enhances overall detection accuracy in real time. The adaptive nature of the boosting mechanism ensures that the model continuously focuses on hard-to-classify threat instances by updating the sample weights during training, thereby improving the system’s sensitivity to emerging or subtle attacks [22].

Figure 2depicts the architecture of the proposed adaptive ensemble learning model for real-time cybersecurity threat detection. It highlights the flow from preprocessing through feature selection, individual classifier training, and final ensemble classification, reflecting the integration of diverse components tailored for dynamic cyber defense.

Figure 2. Architecture of the proposed adaptive ensemble learning system for real-time threat detection.

To evaluate the performance of the proposed framework, real-time network traffic data and system logs are continuously fed into the model during testing. Each data instance is processed through all five weak learners to generate hypotheses h₁, h₂, …, h₅, which are then combined using their respective weights β₁, β₂, …, β₅ to produce the final prediction. This mechanism provides resilience against the non-stationarity and complexity inherent in cyberattack patterns, supporting timely and precise threat detection critical for adaptive cybersecurity systems.

The proposed method embodies a holistic approach to real-time threat detection by synergizing advanced preprocessing, adaptive feature selection, diverse weak learner training, and an innovative heterogeneous boosting ensemble. This design addresses the unique challenges of cybersecurity data streams, delivering an efficient and scalable solution for dynamic threat environments.

The experimental evaluation of the proposed real-time adaptive machine learning framework was conducted using several cybersecurity datasets representative of dynamic network environments and evolving threat scenarios. To simulate realtime operation, we streamed the traffic data at a controlled rate of approximately 10,000 flow records per second, emulating a moderately high-throughput enterprise network. The system ran on a machine equipped with an Intel i7 3.0 GHz CPU and 32 GB RAM, with no GPU acceleration, to reflect a realistic deployment environment. We measured the average per-flow processing time, which remained below 200 ms under these conditions, ensuring that detection latency stays well under typical SLA thresholds. Memory utilization peaked at ~12 GB, while CPU usage averaged 13%, confirming that our adaptive ensemble operates within practical resource bounds. The primary dataset used in this study is the CICIDS2017 dataset [39], which simulates real-world network traffic incorporating benign activities and various cyberattack behaviors including DoS, brute force, botnet, and infiltration. Additionally, supplementary datasets such as UNSW-NB15 [40] and the contemporary CTU-13 botnet traffic dataset [41] were incorporated to validate the generalizability of the framework under different attack types and network configurations.

For reproducibility and robustness, we split each dataset into 70% training, 15% validation, and 15% test sets. To address class imbalance (especially in multi-class scenarios) we applied stratified sampling so that the ratio of benign to malicious classes (and among different attack types) remained consistent across all splits. In addition, for under-represented classes (like botnet or infiltration in multi-class scenario), we applied SMOTE (Synthetic Minority Over-sampling Technique) on the training set only, to avoid inflating performance during validation and testing. The experimental scenarios were divided into two main classification tasks. Scenario 1 involved binary classification between benign and malicious traffic flows, while Scenario 2 extended the classification to multiple attack categories, reflecting the heterogeneity of real-time threats. Table 1 and Table 2detail the distribution of instances across classes for both scenarios.

Table 1.Class distribution for scenario 1 (binary classification).

Table 2. Class distribution for scenario 2 (multi-class classification).

This study presents an innovative application of machine learning techniques tailored for real-time threat detection within adaptive cybersecurity systems. The proposed framework integrates ensemble learning with adaptive feedback mechanisms, enabling dynamic adjustment to evolving cyber threats. Our approach leverages a combination of classifiers including Random Forest, Gradient Boosting, and deep neural networks, optimized to operate synergistically for enhanced detection accuracy. Experiments were conducted on multiple real-time cybersecurity datasets, including CIC-IDS2017 and UNSW-NB15, which encompass a diverse range of contemporary attack vectors and normal network behaviors [39][40].

To effectively manage the large dimensionality and ensure prompt detection, a feature selection pipeline using Recursive Feature Elimination (RFE) with cross-validation was applied, reducing computational overhead without sacrificing performance. The evaluation metrics comprised precision, recall, F1-score, false positive rate, and detection latency, providing a comprehensive assessment of the system’s capabilities in operational environments. Tables 4-5 illustrate confusion matrices for multiple attack categories and normal traffic, while Tables 6-7 summarize the performance indicators demonstrating consistently high detection rates exceeding 98%, alongside minimal false alarms.

Comparative analysis against baseline models such as Support Vector Machines (SVM) and k-Nearest Neighbors (k-NN) confirmed the superiority of the adaptive ensemble in both accuracy and responsiveness. Notably, our system maintained robust performance even when exposed to zero-day attack samples, reflecting its adaptive learning capacity in continuously evolving threat landscapes. This characteristic aligns well with the requirements of real-time cybersecurity operations, where traditional static detection models often fall short [20].

Further experimentation with cross-dataset validation established the model’s generalizability, achieving comparable results across varied traffic patterns and network configurations [14]. The low latency observed in detection and classification processes emphasizes the suitability of the proposed system for deployment in environments demanding immediate threat mitigation, such as enterprise networks and critical infrastructure.

In comparison to existing research utilizing the CIC-IDS2017 dataset, where conventional machine learning algorithms reported accuracies ranging from 85% to 93%, our approach consistently achieved above 98% accuracy, representing a significant advancement in detection efficacy [39]. Moreover, in line with the findings of [43], the integration of adaptive mechanisms within the learning process proved crucial in enhancing the model’s resilience against adversarial evasion attempts.

The experimental results validate that applying machine learning within an adaptive framework for real-time threat detection substantially elevates cybersecurity defenses. The model not only excels in identifying known threats but also demonstrates remarkable proficiency in detecting emerging and unknown attacks, thereby addressing critical gaps in current cybersecurity solutions. The findings encourage further exploration of adaptive ensemble learning paradigms as a foundation for next-generation intrusion detection systems capable of operating effectively in dynamic and complex cyber environments.

Godfrey Wandwi: Conceived and designed the study; conducted the literature review; developed the machine-learning approach for real-time cyber-threat detection; prepared and processed the cybersecurity dataset; implemented and trained the machine-learning models; performed model testing, validation, and performance evaluation; analyzed and interpreted the results; developed the adaptive cybersecurity framework; prepared the figures and tables; and wrote the majority of the manuscript, including the Introduction, Methodology, Results, Discussion, and Conclusion sections. Theodore Habimana: Assisted with reviewing relevant literature; provided technical feedback on the proposed cybersecurity and machine-learning approach; assisted with reviewing and interpreting selected experimental results; contributed to proofreading and editing the manuscript; and provided feedback on the final version of the paper.

The use of AI (Grammarly) assisted language clarity and grammar checking. All content refined by the tool has been thoroughly reviewed and revised by the authors.