Artificial Intelligence-Driven Cybersecurity: A Review of Machine Learning Approaches for Threat Detection and Prevention

Abstract

Cyber attacks have become more frequent, more automated and more difficult to recognise, and the signature-based tools that have long protected networks struggle to keep pace with new and changing threats. Artificial intelligence (AI), and machine learning (ML) in particular, has therefore attracted wide interest as a way to detect and prevent attacks by learning patterns of malicious behaviour from data. It examines the main families of learning techniques and how they are applied; the use of classical and deep models for network intrusion detection; ML-based detection of malware and phishing; and the benchmark datasets, evaluation practices and open challenges that shape the field. The review finds that ensemble methods and deep architectures such as recurrent networks and auto-encoders generally outperform traditional classifiers on benchmark data, and that hybrid models are increasingly common. However, it also finds recurring weaknesses: dependence on outdated or imbalanced datasets, inconsistent evaluation, high false-alarm rates in practice, limited interpretability and vulnerability to adversarial manipulation. The paper concludes that AI is a powerful complement to, rather than a replacement for, conventional defences, and it outlines future research directions in realistic datasets, explainable and adversarially robust models, continual learning and automated response.