标题： 基于人工智能的网络安全威胁检测：使用预测分析构建弹性防御系统 显示英文标题

标题： AI-Driven Cybersecurity Threat Detection: Building Resilient Defense Systems Using Predictive Analytics

摘要： 本研究考察人工智能如何在美国的四个关键领域中帮助识别和缓解网络威胁：入侵检测、恶意软件分类、钓鱼检测和内部威胁分析。 这些问题各有特点，意味着需要针对每个问题采取不同的方法，因此我们将模型与问题的形态相匹配。 在入侵检测方面，用于捕捉未经授权的访问等问题，我们测试了无监督异常检测方法。 隔离森林和深度自编码器都通过检测网络流量中的异常模式提供了有用信号。 在恶意软件检测方面，我们依赖于集成模型，如随机森林和XGBoost，这些模型是基于从文件和流量日志中提取的特征进行训练的。 钓鱼问题则更为直接。 我们向标准分类器（逻辑回归、随机森林、XGBoost）提供电子邮件和基于网络的特征组合。 这些模型出乎意料地很好地完成了任务。 钓鱼问题似乎是我们手头数据中最容易解决的问题。 但情况不同。 我们利用LSTM自编码器来识别用户活动日志中的行为异常。 它捕捉到了每一种可疑行为，但也标记了很多无害的行为。 当遗漏威胁的成本很高且你愿意筛选一些噪声时，这种模型是有意义的。 我们发现，总体而言，性能并不在于堆叠最复杂的模型。 重要的是模型结构与数据行为方式的匹配程度。 当信号强大且明显时，简单的模型就足够了。 但对于更混乱、更微妙的威胁，我们需要更具适应性的模型，如序列模型和异常检测器，尽管它们带来了各自的权衡。 这里得出的结论是明确的，在网络安全中，上下文驱动解决方案。 显示英文摘要

摘要： This study examines how Artificial Intelligence can aid in identifying and mitigating cyber threats in the U.S. across four key areas: intrusion detection, malware classification, phishing detection, and insider threat analysis. Each of these problems has its quirks, meaning there needs to be different approaches to each, so we matched the models to the shape of the problem. For intrusion detection, catching things like unauthorized access, we tested unsupervised anomaly detection methods. Isolation forests and deep autoencoders both gave us useful signals by picking up odd patterns in network traffic. When it came to malware detection, we leaned on ensemble models like Random Forest and XGBoost, trained on features pulled from files and traffic logs. Phishing was more straightforward. We fed standard classifiers (logistic regression, Random Forest, XGBoost) a mix of email and web-based features. These models handled the task surprisingly well. Phishing turned out to be the easiest problem to crack, at least with the data we had. There was a different story. We utilized an LSTM autoencoder to identify behavioral anomalies in user activity logs. It caught every suspicious behavior but flagged a lot of harmless ones too. That kind of model makes sense when the cost of missing a threat is high and you are willing to sift through some noise. What we saw across the board is that performance was not about stacking the most complex model. What mattered was how well the models structure matched the way the data behaved. When signals were strong and obvious, simple models worked fine. But for messier, more subtle threats, we needed something more adaptive, sequence models and anomaly detectors, though they brought their trade offs. The takeaway here is clear in cybersecurity, context drives the solution.