Unsupervised AI-Based cybersecurity threat identification through feature analysis and Clustering on Network Traffic.

Cybersecurity is becoming a major issue, and the unlabeled data provide difficulty in detection. The research is on the application of unsupervised artificial intelligence in detecting anomalous network behavior, such as zero-day attacks. The proposed solution is a feature analysis and clustering-based methodology to identify common as well as the evasive attack patterns on the unlabeled network traffic. The benchmark datasets, CICIDS2017 and NSL-KDD, had been experimented on, and the performance of the model also was measured in terms of standard measures such as precision, recall, F1-score and ROC-AUC. The results of clustering clearly show that there is a considerable distance between normal traffic and abnormal traffic; thus, distinguishing between unknown attacks and causes of false positives is minimized. These results underline the fact that unsupervised AI could promote real-time network security even in cases where there are limited labeled data. Note: This is a preprint and has not yet been peer-reviewed.