An AI-Driven Framework for Real-Time Anomaly Detection and Self-Mitigation in Distributed Networks

Abstract

Traditional Intrusion Detection Systems (IDS) face a critical limitation: the detection-response gap. This temporal delay between identifying an attack and executing a miti-gation action creates a vulnerability window that modern automated threats can easily exploit. Centralized architectures, reliance on static rules, and human intervention further exacerbate this problem, particularly in large-scale or high-speed network environments. To address this challenge, this thesis proposes an AI-driven framework for real-time anomaly detection and self-mitigation deployed at the network edge. The proposed system integrates three main components: a hybrid detection mechanism combining signature-based and anomaly-based characteristics using supervised machine learning, an inline edge-based architecture that processes traffic locally without relying on centralized in-frastructure, and an automated response mechanism that enforces immediate counter-measures upon detection. The system was implemented and evaluated within a virtualized network environ-ment using PNETLab. Two ensemble learning algorithms, Random Forest and XGBoost, were compared using the CIC-IDS2017 dataset. Experimental results show that XGBoost achieves an overall accuracy of 99.65% and a macro F1-score of 88.53%, outperforming Random Forest in precision while maintaining competitive recall. The system demon-strates a detection-to-block latency of approximately 15.38 milliseconds, effectively closing the attack window. These findings confirm that deploying an AI-based IDS with automated response at the network edge is a feasible and effective strategy for minimizing the detection-response gap, offering a practical solution for enhancing network security in real-time environments.