A Machine Learning-Based Framework for Real-Time Anomaly Detection and Cyberattack Prediction

Abstract

This study aims to develop and evaluate a machine learning-based framework capable of performing real-time anomaly detection and cyberattack prediction within network traffic data, addressing the growing need for intelligent, responsive cybersecurity mechanisms in increasingly interconnected digital environments. The objective is to design an integrated pipeline that connects anomaly identification with cyberattack-type classification, rather than treating these as separate tasks, while systematically evaluating predictive performance using established classification measures and assessing the framework's suitability for real-time operational deployment through computational efficiency testing. The proposed framework demonstrated strong binary classification performance in distinguishing benign traffic from anomalous behaviour, achieving high accuracy alongside low false positive and false negative rates. Multi-class cyberattack prediction performed particularly well for high-frequency attack categories, though detection reliability declined for rare and underrepresented attack types, reflecting the influence of class imbalance on model performance. Real-time inference testing confirmed minimal processing latency and substantial throughput using standard computational resources, supporting the framework's practical responsiveness. The findings confirm that combining anomaly detection with cyberattack prediction within a unified framework is both technically feasible and computationally efficient, offering practical value for resource-constrained network monitoring environments. However, the disparity in rare-class detection highlights the need for future work addressing class imbalance, comparative model evaluation, and validation under live streaming conditions to strengthen real-world applicability.