Agentic AI for Autonomous Cyber Threat Hunting and Adaptive Defense in Dynamic Security Environments
Bibliographic record
Abstract
Evolution of cyber threats have led to limitations in the efficiency of traditional rule-based cybersecurity approaches. These traditional interventions have remained to have a resource intensive and reaction approach, prompting the creation of new steps that can help in handling cyber threats through AI. This study develops an AI driven system for autonomous cyber threat hunting, through leveraging Machine Learning (ML), Deep Reinforcement Learning (RDL) and using AI analytics to ensure a proactive detection, resolution and management of threats. The study uses datasets such as DARPA and CIDS ensuring that they can work on an AI intervention. The use of ML models such as CNN and RNN ensure analysis of the network traffic, behavioral indicators and system logs. Using DRL enables the system to have an autonomous adaptation to threats such as zero day exploits, reducing the instances of false positives and false negatives. Results from this study indicates that using AI driven threat detection leads to an accuracy rate of 98.2%, F1 score of 97.1% while reducing both MTTD and MTTR by an estimated 99%. The findings depict the ability of the system to have an operational framework demanding minimal human intervention. Thus, the cybersecurity operations can be advanced to have an increasingly transformative engagement, working on proactive threat detection and reducing operational costs. Considerably, future research should focus on enhancing Explainability in AI, addressing ethical issues and countering growing adversarial attacks on the AI system.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.000 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.000 | 0.000 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.000 | 0.000 |
| Open science | 0.000 | 0.000 |
| Research integrity | 0.000 | 0.000 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".