Research · Oct 2025
AI-Driven Hybrid Cybersecurity Audit Framework for Non-Governance IT Systems
I score network traffic, then ask a language model to draft an incident note a person still has to check.
AI-Driven Hybrid Cybersecurity Audit Framework for Non-Governance IT Systems media, 5 items. Use the arrow keys to move.
Logistic regression ROC, AUC 0.93.
A model that flags a packet is not an audit. Someone still has to read the high-risk rows and decide what happened.
The problem
A score on a row does not say what the traffic did. It says the row looked unusual. The person reading an incident still has to write the note: which flow, what it resembled, why it was pulled out of the table. A pipeline that stops at the number leaves that note to be typed from scratch.
That is who it frustrates. An analyst with a ranked list and no draft is doing the model’s last step by hand. I wanted the scores and a first draft of the note in the same pipeline, with the draft still waiting on a person. A note nobody checks is not an audit either.
How I built it
The data is UNSW-NB15. I clean the tables first, because a score on a dirty row is a score about the dirt. Then four models read the same cleaned table: isolation forest, logistic regression, gradient boosting, and XGBoost. They are not there to vote as a committee. They are there because the same table does not produce the same ranking.
Logistic regression landed at accuracy 0.8467, with a ROC figure labeled AUC 0.93. Isolation forest was much weaker on the same data: accuracy 0.5090 and AUC 0.57. Gradient boosting and XGBoost sit in that comparison so the tree models are not a footnote to the linear one.
The top-risk rows, not the whole table, go to a language model. The model drafts the incident note from those rows. Sending every row would have buried the draft in traffic that the scores already called ordinary. The draft is the start of the note. It is not the sign-off.
Challenges and what I learned
Isolation forest and logistic regression disagreed by a wide margin on one table. If I had shipped the weaker score as the audit, the draft note would have been about the wrong rows. That gap is why the note still has to be checked by a person, and why this work is written up as a book chapter rather than as a detector you turn on and walk away from.
