Abstract
Changing modern cybersecurity threats make it necessary for organizations to develop security detection systems that integrate supervised learning capabilities with standard security data and historic logs. We propose adopting a multi-level machine learning framework to classify threats by unifying security data from NVD, CVE, VulDB, CAPEC, ATT&CK and CWE sources. The security system performs pre-processing on data before using Decision Trees, Random Forests, Bagging, Boosting and XGBoost algorithms to build features that strengthen threat detection performance. We chose ensemble learning to achieve optimal predictions in threat assessment. The experimental data demonstrates that XGBoost delivers better results among other tested models since it detects cyber threats with a 97.2% success rate, which shows its capability to detect password attacks, phishing details, SQL injection threats, ransomware and DDoS events. Continuous improvement in the system comes from expert feedback systems, which generate patterns when ranking vulnerabilities. The proposed system presents real-time tracking abilities together with dynamic threat-detection methods that enable organizations to use an advanced system for facing emerging cyber threats.