Abstract

The rising complexity of cyber threats targeting Windows systems necessitates advanced, real-time security solutions to counter zero-day and malware-free attacks. This paper presents the CyberVisionet Security Suite, a Windows security monitoring system that utilizes a Bidirectional Long Short-Term Memory (LSTM) network with an attention mechanism to identify suspicious activities within Windows event logs. The system analyzes event sequences, such as logins and process creations, to detect anomalous patterns indicative of potential threats. A rule-based heuristic framework labels sequences as normal or suspicious, which are then balanced using undersampling and used to train the LSTM model on the Unified Host and Network Dataset from Los Alamos National Laboratory. The enhanced model achieves an accuracy of 99.16% and an F1-score of 98.88% on the test set, markedly improving over the previous iteration’s 33.93% F1-score. Real-time testing further confirms its effectiveness in identifying suspicious activities. The CyberVisionet Security Suite offers a scalable and interpretable solution for enterprise security, with future potential for enhancements like network monitoring and adaptive thresholding.