Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{195534,
        author = {D.Satya Priya and Mr.J.Naresh Kumar and D.Shravani and N.Sri Laxmi and V.Sravani},
        title = {CyberShield AI: A Prototype Multi-Agent Framework for Simulated Cyber Threat Detection, LLM-Assisted Risk Analysis, and Explainable Automated Response Recommendations},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {11},
        pages = {1215-1229},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=195534},
        abstract = {This paper presents CyberShield AI, a prototype multi-agent cybersecurity monitoring framework constructed to investigate the feasibility of coordinating modular AI-based components for automated threat detection, risk analysis, and structured response recommendation within a simulated network environment. The system comprises five purpose-built agents — Hunter, Analyst, Responder, Reporter, and Watchdog — organized as a sequential processing pipeline that operates over synthetically generated network access log data. The prototype does not ingest live network streams, execute autonomous remediation actions, or operate against real-world infrastructure; all evaluations are conducted within a controlled simulation environment using a synthetic dataset produced by an integrated log generation module.
In controlled experimental evaluation, the pipeline processed 1,526 synthetic log records in 2.1 seconds, identifying 458 anomalous entries at a mean detection confidence of 75%. The platform exposes a seven-section Streamlit dashboard providing simulated threat metrics, geographic origin visualization of synthetic attack sources, per-agent conversational interfaces, incident-level SHAP feature attribution, counterfactual scenario analysis, and configurable report generation. A FastAPI REST backend with full OpenAPI documentation and Docker Compose containerization supports repeatable deployment of the prototype. By integrating ensemble machine learning anomaly detection, optional GPT-4-assisted risk narration, structured response planning heuristics, and post- hoc model explainability within a single modular workflow, CyberShield AI demonstrates a defensible design architecture for future research toward operationally viable security automation tooling, while acknowledging the substantial gap between prototype demonstration and production-grade deployment.},
        keywords = {Multi-Agent Systems, Cybersecurity Prototype, Anomaly Detection, Large Language Models, Explainable AI, SHAP, Response Recommendations, Isolation Forest, Random Forest, Streamlit, FastAPI, Docker, Synthetic Dataset, Modular Pipeline.},
        month = {April},
        }