Authors:
T. Senthil Kumar, J. Jayapradha, B. Roahan, Mardeni Roslee, Unmesh Suryawanshi, S. Sharan Jeev

Addresses:
Department of Computing Technologies, Faculty of Engineering and Technology, SRM Institute of Science and Technology, Kattankulathur, Chennai, Tamil Nadu, India. Department of Computing Technologies, SRM Institute of Science and Technology, Kattankulathur, Chennai, Tamil Nadu, India. Faculty of Engineering, Multimedia University, Cyberjaya, Selangor, Malaysia. Department of Information Technology, Visa Inc., Foster City, California, United States of America. Department of Cybersecurity, University of Texas at Dallas, Richardson, Texas, United States of America.

Abstract:

Hybrid enterprises today encounter cyber threats that evolve faster than rule-based NDR systems. Manual alert triage becomes harder as noise levels rise. In this paper, researchers propose a state-of-the-art NDR solution developed, deployed, and tested on real enterprise network traffic. It combines Suricata NIDS with a multi-stage ML pipeline that analyzes network-flow anomalies and classifies live sessions. A Python script monitors Suricata's EVE log, performs noise reduction through bilateral filtering, and passes relevant events to a FastAPI backend in JSON format. Each network flow is characterized by 78 attributes, including statistical, protocol-level, timing, payload analysis, and behavioral indicators. The system assigns threat scores using a stacked ML architecture consisting of Isolation Forest, OC-SVM, BiLSTM, and XGBoost models. Alerts are grouped by severity and annotated using the MITRE ATT&CK framework before being sent to the React frontend per tenant via WebSockets. The SaaS stack includes JWT authentication, role-based access control, tenant isolation, Dockerization, and PostgreSQL 16. Offline model training uses the CIC-IDS2018 and UNSW-NB15 datasets, while validation uses real captured flows. Our results show that combining rule-based monitoring with statistical scoring and deep sequential learning with gradient boosting provides an efficient way to implement NDR in a SaaS environment.

Keywords: AI-Driven Network Detection; Response Platform; Real-Time Intrusion Detection; Stacked Machine Learning; Anomaly Detection; Saas Security; Live Traffic Monitoring; JWT Authentication.

Received on: 14/07/2025, Revised on: 23/09/2025, Accepted on: 12/11/2025, Published on: 09/06/2026

DOI: 10.69888/FTSIS.2026.000774

FMDB Transactions on Sustainable Intelligence and Security, 2026 Vol. 1 No. 2, Pages: 118-128

• Views : 33
• Downloads : 8

Download PDF