AI Based Zero-Day Attack Detection Using Machine Learning

A zero-day attack abuses a weakness that nobody has documented yet, so a signature-based intrusiondetection system has nothing to match it against. Machine learning offers another route: learn what normaland malicious traffic look like instead of memorising known patterns. The difficulty is that manypublished detectors are evaluated with random train/test splits, which quietly place every attack type in thetraining data and say little about behaviour the model has never met. This paper proposes a framework andan evaluation protocol aimed at that specific weakness. The framework is a hybrid detector that fuses asupervised gradient-boosted classifier, which is sharp on attack patterns it has seen, with an autoencodertrained on benign traffic only, which needs no attack labels and can flag behaviour that merely looksunfamiliar. The protocol uses flow-level records from the CIC-IDS2017 dataset and hides one wholeattack family at a time during training (leave-one-attack-family-out), calibrates every model to the samefalse-positive budget, and reports detection, false alarms, ranking quality and scoring cost side by side.The paper describes the design, the data handling, the baselines, the metrics and the analysis plan inenough detail to be reproduced, and discusses the threats to validity that any such study must face. It is astatement of method rather than a report of measured outcomes, and the held-out setting it describe