Adaptive Intrusion Detection and Automated Cryptographic Response Framework for Real-Time Cyber Threat Mitigation

Abstract

The increasing dynamics of cyberattacks require security systems that are not only capable of detecting threats but also responding rapidly, adaptively, and proportionally. This study proposes the Adaptive Intrusion Detection and Automated Cryptographic Response (AID-ACR) Framework, a closed-loop cybersecurity approach integrating intrusion detection, dynamic threat-risk assessment, automated response, cryptographic mechanisms, and adaptive feedback. The prototype was evaluated through a reproducible simulation study using 32,000 synthetic CICIoT-like traffic samples with 39 numerical features and eight classes: Benign, DDoS, DoS, Recon, Web, Brute Force, Spoofing, and Mirai. Random Forest, XGBoost, LightGBM, and a DNN based on a multilayer perceptron were compared as intrusion detection engines. LightGBM achieved the best overall detection performance with 98.77% accuracy, 98.66% macro-precision, 97.21% macro-recall, and 97.91% macro-F1. The adaptive threat-risk assessment achieved 94.44% agreement with the reference simulation policy and reduced the Unnecessary Response Rate from 0.9749% under static response to 0.5571%, a relative reduction of 42.86%. The prototype produced an end-to-end threat mitigation latency of 0.659 ms per event. These findings indicate that AID-ACR can reduce the detection-to-mitigation gap by combining contextual network controls with cryptographic actions such as session re-keying, key rotation, and key revocation. Validation using the official CICIoT2023 files and a real network testbed remains necessary before operational deployment.