AI Based Threat Detection System In Network

Network intrusion detection must adapt to changing traffic while preserving recognition of previously observed attacks. This paper studies the trade-off between retraining frequency, labelled sample size, and detection performance, and designs an evidence-guided security operations centre (SOC) workflow around the detector. A 100-tree Random Forest is evaluated on six constructed traffic windows with increasing proportions of DDoS and PortScan attacks. Across five paired random seeds, an output-based adaptive policy achieves 92.008% pooled incoming attack recall, compared with 92.302% for retraining every two windows, while reducing mean retraining counts from 3.0 to 1.8. No drift alarms occur in the tested stable controls. However, exact-feature grouped evaluation exposes a concentrated retention failure: one seed loses detection of 883 previously recognised old attack rows after an update. A separate validation-gate experiment accepts every candidate and therefore does not establish a protective benefit. A small FTP capture further shows that successful feature conversion does not guarantee attack recognition: all 30 flows are classified benign despite evidence of repeated failed logins. The proposed architecture connects detection with packet investigation, indicator extraction, timelines, evidence-grounded analysis, ATT&CK mapping, and analyst-approved response. Results support a limited offline cost–recall trade-off, while identifying retention, labelling realism, and extractor compatibility as unresolved requirements.