Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{209124,
        author = {Badipatla Sri Naga Parameswari Noditha and Kasukurthi Venkata Rao},
        title = {AI-Powered cyber threat hunting bot for intelligent detection ,correlation and analysis of network security threats},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {13},
        number = {5},
        pages = {1013-1019},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=209124},
        abstract = {The continuous growth in the volume and diversity of network security telemetry has made purely manual threat hunting increasingly difficult for security analysts, while reliance on signature-based detection alone limits the identification of behaviorally novel activity. This study presents an integrated, prototype-level AI-assisted cyber threat-hunting framework that combines supervised machine learning, unsupervised anomaly detection, threat scoring, event correlation, standardized adversarial-technique mapping, knowledge graph representation, and a conversational analyst interface into a single experimental pipeline. The publicly available CIC-IDS2017 network-flow dataset, comprising 2,827,876 processed records across 78 numerical features, was used as the empirical basis. A Random Forest classifier achieved an initial random train/test accuracy of 99.91%, precision of 99.65%, recall of 99.87%, and an F1-score of 99.76%. Feature-importance analysis identified Destination Port, backward packets per second, and packet-length statistics as key predictors. An Autoencoder was additionally trained on 100,000 benign only samples to support unsupervised anomaly detection. Detection and contextual outputs were subsequently used to generate categorical threat scores, group related events into 53,791 correlation clusters, and produce 15 mapping records linking attack categories to MITRE ATT&CK Enterprise (v19.2) techniques. A threat knowledge graph comprising 20,663 nodes and 55,000 edges was constructed, and an analyst-facing conversational chatbot was implemented to retrieve backend information in natural language. The study demonstrates the technical feasibility of integrating these components into a unified threat-hunting workflow},
        keywords = {Cyber Threat Hunting, Intrusion Detection, Random Forest, Autoencoder, MITRE ATT&CK, Knowledge Graph},
        month = {October},
        }