An Explainable Hybrid AI Framework for Real-Time Cyber Threat Detection, Predictive Intelligence and Adversarially Robust Defense

Artificial-intelligence-based intrusion detection must simultaneously address detection accuracy, early warning, adversarial robustness, interpretability, and operational latency. This study presents an explainable hybrid AI framework that combines supervised classifiers with unsupervised anomaly detection for near-real-time cyber threat detection and predictive intelligence. The controlled experiment contains 18,000 observations described by 16 network and host-behavior features, partitioned into 10,800 training, 3,600 validation, and 3,600 held-out test records. The proposed hybrid detector achieved 92.25% accuracy, 89.40% precision, 82.93% recall, 86.04% F1-score, 96.02% specificity, ROC-AUC 0.948, and PR-AUC 0.922 at a validation-selected threshold of 0.58. The confusion matrix contained 860 true positives, 2,461 true negatives, 102 false positives, and 177 false negatives. Five-fold validation produced a mean F1-score of 85.29%, while bootstrap analysis yielded a 95% F1 interval of 84.34-87.59%. The predictive module detected 89.23% of attack episodes with a median warning lead of 6.0 s and ROC-AUC of 0.989. Under the strongest bounded evasion test (epsilon=0.40), adversarial augmentation retained 92.57% recall compared with 73.58% under standard training. SHAP and LIME analyses identified destination-port count, failed logins, process-spawn rate, and connection rate as influential indicators. Median single-record inference was 124.83 ms and batch throughput reached 11,029 records/s. These results demonstrate a promising integrated approach, while the findings remain controlled-simulation results pending external validation on public and enterprise traffic.