Hybrid AI-Based Framework for Real-Time Cyber Threat Detection and Prevention Using Isolation Forest and Rule-Based Intelligence
Keywords:
cybersecurity; isolation forest; rule-based intelligence; hybrid artificial intelligence; real-time cyber threat detection; threat preventionAbstract
With the proliferation of cloud computing, the Internet of Things (IoT), Industrial IoT (IIoT) and enterprise networks, cyberattacks are no longer a rarity and have become increasingly sophisticated, making real-time intrusion detection a critical need. Traditional Intrusion Detection Systems tend to generate false positives, are unable to recognize unknown attacks, are not automated in preventing attacks, and cannot be readily interpreted. In this paper, a hybrid proposal of real-time cyberthreat detection and prevention based on Isolation Forest and adaptive rule-based intelligence is proposed. Two modules are used: the first, named Isolation Forest, is a unsupervised anomaly detection module, and the second, called rule-based, is used for the validation of suspicious activities according to cybersecurity policies. Hybrid Fusion Engine uses both Anomaly scores and Rule-Validation results to increase detection accuracy. It also features threat-severity assessment, automated threat-response mitigation, and a real-time threat dashboard that provides ongoing security monitoring. The accuracy of evaluation by using the benchmark dataset of CICIDS2017 was 99.21%, the precision was 98.95%, the recall rate was 98.68%, the F1-score was 98.81%, the ROC-AUC was 0.996, the false-positive rate was 0.74%, and the average detection time was 28.4ms. The results highlight that the proposed framework is effective, scalable and intelligent for real-time cyberthreat detection and prevention in enterprise, cloud and IoT environments.References
[1]. Zhang, P., He, F., Zhang, H., Hu, J., Huang, X., Wang, J., Yin, X., Zhu, H., & Li, Y. (2023). Real-time malicious traffic
detection with online isolation forest over SD-WAN. IEEE Transactions on Information Forensics and Security, 18,
2076–2090. https://doi.org/10.1109/TIFS.2023.3262121
[2]. Chua, W., Pajas, A. L. D., Castro, C. S., Panganiban, S. P., Pasuquin, A. J., Purganan, M. J., Malupeng, R., Pingad, D. J.,
Orolfo, J. P., Lua, H. H., & Velasco, L. C. (2024). Web Traffic Anomaly Detection Using Isolation Forest. Informatics, 11(4),
83. https://doi.org/10.3390/informatics11040083
[3]. Wang, C., Sun, Y., Wang, W., Liu, H., & Wang, B. (2023). Hybrid Intrusion Detection System Based on Combination
of Random Forest and Autoencoder. Symmetry, 15(3), 568. https://doi.org/10.3390/sym15030568
[4]. Awajan, A. (2023). A Novel Deep Learning-Based Intrusion Detection System for IoT Networks. Computers, 12(2),
34. https://doi.org/10.3390/computers12020034
[5]. Elsaid, S. A., & Binbusayyis, A. (2024). An optimized isolation forest-based intrusion detection system for
heterogeneous and streaming data in the industrial Internet of Things (IIoT) networks. Discover Applied Sciences, 6,
Article 483. https://doi.org/10.1007/s42452-024-06165-w
[6]. Kumar, A., & Gutierrez, J. A. (2025). Impact of Machine Learning on Intrusion Detection Systems for the Protection
of Critical Infrastructure. Information, 16(7), 515. https://doi.org/10.3390/info16070515
[7]. Zhang, H., & Zhang, H. (2025). Anomaly Detection and Objective Security Evaluation Using Autoencoder, Isolation
Forest, and Multi-Criteria Decision Methods. Sensors, 25(19), 6250. https://doi.org/10.3390/s25196250
[8]. Heigl, M., Anand, K. A., Urmann, A., Fiala, D., Schramm, M., & Hable, R. (2021). On the Improvement of the Isolation
Forest Algorithm for Outlier Detection with Streaming Data. Electronics, 10(13), 1534.
https://doi.org/10.3390/electronics10131534
[9]. Azam, Z., Islam, M. M., & Huda, M. N. (2023). Comparative analysis of intrusion detection systems and machine
learning-based model analysis through decision tree. IEEE Access, 11, 80348–80391.
https://doi.org/10.1109/ACCESS.2023.3296444
[10]. Khan, N., Ahmad, K., Al Tamimi, A., Alani, M. M., Bermak, A., & Khalil, I. (2025). Explainable AI-Based Intrusion
Detection Systems for Industry 5.0 and Adversarial XAI: A Systematic Review. Information, 16(12), 1036.
https://doi.org/10.3390/info16121036
[11]. Hozouri, A., Mirzaei, A., & Effatparvar, M. (2025). A comprehensive survey on intrusion detection systems with
advances in machine learning, deep learning and emerging cybersecurity challenges. Discover Artificial Intelligence, 5,
Article 314. https://doi.org/10.1007/s44163-025-00578-1
[12]. Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2021). Network intrusion detection system: A
systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications
Technologies, 32(1), e4150. https://doi.org/10.1002/ett.4150
[13]. Rahman, M. A., Asyhari, A. T., Leong, L. S., Satrya, G. B., Tao, M. H., & Zolkipli, M. F. (2020). Scalable machine
learning-based intrusion detection system for IoT-enabled smart cities. Sustainable Cities and Society, 61, Article
102324. https://doi.org/10.1016/j.scs.2020.102324
[14]. Zhang, H., Huang, L., Wu, C. Q., & Li, Z. (2020). An effective convolutional neural network based on SMOTE and
Gaussian mixture model for intrusion detection in imbalanced dataset. Computer Networks, 177, Article 107315.
https://doi.org/10.1016/j.comnet.2020.107315
[15]. Verma, A., & Ranga, V. (2020). Machine learning based intrusion detection systems for IoT applications. Wireless
Personal Communications, 111, 2287–2310. https://doi.org/10.1007/s11277-019-06986-8
[16]. Laskar, M. T. R., Huang, J. X., Smetana, V., Stewart, C., Pouw, K., An, A., Chan, S., & Liu, L. (2021). Extending isolation
forest for anomaly detection in big data via K-means. ACM Transactions on Cyber-Physical Systems, 5(4), Article 41.
https://doi.org/10.1145/3460976
[17]. Alnasser, O., Al Muhtadi, J., Saleem, K., & Shrestha, S. (2025). Signature and anomaly-based intrusion detection
system for secure IoTs and V2G communication. Alexandria Engineering Journal, 125, 424–440.
https://doi.org/10.1016/j.aej.2025.03.068
[18]. Ashraf, M. W. A., Singh, A. R., Pandian, A., Rathore, R. S., Bajaj, M., & Zaitsev, I. (2024). A hybrid approach using
support vector machine rule-based system: Detecting cyber threats in Internet of Things. Scientific Reports, 14(1),
Article 27058. https://doi.org/10.1038/s41598-024-78976-1
[19]. Qazi, E. U. H., Faheem, M. H., & Zia, T. (2023). HDLNIDS: Hybrid Deep-Learning-Based Network Intrusion Detection
System. Applied Sciences, 13(8), 4921. https://doi.org/10.3390/app13084921
[20]. Mohale, V. Z., & Obagbuwa, I. C. (2025). Evaluating machine learning-based intrusion detection systems with
explainable AI: Enhancing transparency and interpretability. Frontiers in Computer Science, 7, Article 1520741.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Journal of Intelligent Machine Learning and IoT Enabled Applications
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
