Evaluación de modelos de inteligencia artificial para la detección de amenazas cibernéticas: un enfoque hacia agentes autónomos de seguridad

Abstract

Abstract: This work develops and evaluates a set of artificial intelligence models applied to the detection of cyber threats across different domains, including network traffic, IoT environments, and static malware analysis. Five widely used research datasets (CICIDS2017, UNSW-NB15, NSL-KDD, TON_IoT, and EMBER) were employed in this study, undergoing specific processes of cleaning, transformation, and normalization according to their characteristics. Based on these datasets, supervised, deep, unsupervised, and hybrid models were trained, and their performance was evaluated using experimental metrics such as accuracy, precision, recall, and macro F1-score. The results show that tree-based models, particularly XGBoost, demonstrate greater stability in scenarios with tabular data, while the performance of deep neural networks is more dependent on dataset complexity and the availability of computational resources. In parallel, a functional prototype was developed that integrates the trained models along with a preliminary heuristic capable of performing structural pre-analysis, selecting the appropriate model, and complementing the final classification. The system demonstrates the feasibility of the hybrid approach and lays the foundation for future research focused on autonomous cybersecurity agents.