aiqbench analysis
This research addresses the critical latency gap in cybersecurity by deploying machine learning models directly within software-defined networks to neutralize attacks before lateral movement occurs. The system successfully demonstrated sub-30-second response times against SYN flooding, effectively matching the accelerating speed of modern eCrime breakout windows without human intervention. By automating detection and mitigation loops, this work represents a significant step toward resilient infrastructure capable of keeping pace with adversarial evolution.
Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning
arXiv:2608.22075v1 Announce Type: cross Abstract: Adversaries now move faster than manual response processes can absorb. The average eCrime breakout time, that is, the interval between initial access and the first lateral movement to another host, fell to 29 minutes in 2025, a 65\% increase in speed over the previous year; the fastest observed breakout took 27 seconds, and in one intrusion data exfiltration began within four minutes of initial access. This work presents a machine learning based system that monitors network traffic in real time, diagnoses attacks, and automatically applies countermeasures in software-defined networks, so that detection and response no longer depend on human intervention. The system comprises two modules: \textit{Network Dataset Creation} (NDC), which collects IP flows, preprocesses and aggregates them to build the training dataset, and \textit{Intrusion Prevention System} (IPS), which automates the modeling, training, and evaluation of different algorithms and triggers blocking actions on the SDN controller. A case study with a \textit{SYN flooding} denial of service attack, shows the attack being detected and blocked in 21 seconds without human intervention, a response time compatible with the window imposed by current breakout times.
Abstract:Adversaries now move faster than manual response processes can absorb. The average eCrime breakout time, that is, the interval between initial access and the first lateral movement to another host, fell to 29 minutes in 2025, a 65\% increase in speed over the previous year; the fastest observed breakout took 27 seconds, and in one intrusion data exfiltration began within four minutes of initial access. This work presents a machine learning based system that monitors network traffic in real time, diagnoses attacks, and automatically applies countermeasures in software-defined networks, so that detection and response no longer depend on human intervention. The system comprises two modules: \textit{Network Dataset Creation} (NDC), which collects IP flows, preprocesses and aggregates them to build the training dataset, and \textit{Intrusion Prevention System} (IPS), which automates the modeling, training, and evaluation of different algorithms and triggers blocking actions on the SDN controller. A case study with a \textit{SYN flooding} denial of service attack, shows the attack being detected and blocked in 21 seconds without human intervention, a response time compatible with the window imposed by current breakout times.
Cryptography and Security (cs.CR); Machine Learning (cs.LG)
arXiv:2608.22075 [cs.CR]
(or arXiv:2608.22075v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2608.22075 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 279 words
