Adaptive Resilience in Business Transactions: Mitigating ML-Orchestrated Cyber Threats via Cryptographic and Behavioural Defence Walls

Abstract

Business intelligence (BI) systems increasingly rely on data-driven architectures to facilitate informed financial and operational decisions. However, the integration of advanced algorithms into these platforms has also enabled malicious actors to deploy sophisticated, machine-learning (ML)-orchestrated cyberattacks that easily bypass traditional security signatures. To address this vulnerability, this study proposes a hybrid defensive framework combining elliptic-curve cryptography (ECC) and ML to secure the computational and authentication infrastructure underpinning BI transaction pipelines against automated adversarial threats. A mathematical model grounded in mapping theory was developed to facilitate real-time anomaly detection and adaptive threat mitigation. Furthermore, the proposed architecture introduces a continuous user authentication protocol that evaluates login attempts against established behavioural profiles, immediately flagging divergent access patterns for secondary review. For empirical validation, the framework was evaluated using hardware performance counter (HPC) telemetry from the Canadian Institute for Cybersecurity DDoS Attack Dataset (CICEV2023) within a virtualised execution environment. Low-level execution metrics, including CPU cycles, branch instructions, and executed instructions, were analysed as an infrastructure-tier proxy to assess computational exhaustion and instruction diversion under adversarial authentication attacks. Six ML algorithms were evaluated for intrusion detection. The random forest classifier demonstrated superior performance, achieving an accuracy of 81.58%, a specificity of 89.36%, a precision of 80.00%, and an area under the curve (AUC) of 89.29%. The findings indicate that integrating ECC-based cryptographic verification with ML-driven behavioural analysis yields a resilient, multi-layered defence scheme capable of identifying and mitigating infrastructure-level cyber threats in real-time.

1. Introduction

Business intelligence (BI) technologies have improved business transactions, transforming raw data into informed decisions, with machine learning (ML) operations advancing in the cybersecurity landscape, ushering in an era characterised by incomparable levels of sophistication in BI systems as well as cyber threats [1,2,3]. The most troubling are ML-orchestrated attacks, where malicious actors harness the power of ML algorithms to orchestrate breaches on business transactions [4,5,6]. These attacks, driven by persistent malicious actors to execute data theft or sabotage industries’ financial records, pose a significant challenge to the existing conventional defence schemes, which necessitate the development of state-of-the-art defensive schemes [7,8,9,10]. As establishments progressively rely on data-driven decision-making and automation to drive operational efficiency and competitive advantage, they become increasingly vulnerable to the malicious effects of emerging ML-orchestrated attacks [10,11,12,13].

ML strategies often depend on predefined signatures or patterns, as ML-orchestrated attacks exhibit a level of sophistication that surpasses conventional detection approaches, making them particularly deceptive and difficult to moderate [14,15,16]. Using advanced algorithms and iterative learning processes, malicious actors complicate their activities, bypassing detection while exploiting vulnerabilities with extraordinary precision [17,18,19,20]. Conversely, in today’s digital age, ML-orchestrated attacks result in conceding sensitive financial business transactions, destroying public trust, and disrupting critical operations that result in significant financial consequences [21,22,23,24]. The threat landscape, encompassing historical perspective, attacker motivations, and potential concerns, is crucial for developing effective defences against the ever-evolving manoeuvres of malicious cybercriminals [25,26,27].

As business intelligence systems increasingly transform raw data into informed operational decisions within the evolving landscape of artificial intelligence (AI) and ML, they inadvertently attract a heightened echelon of cyber threats. Specifically, sophisticated ML-orchestrated attacks bypass traditional defences by impersonating legitimate behaviours, leveraging adversarial data manipulation, and coordinating automated incursions [28,29,30]. To address this, this study systematically investigates the anatomy of these ML-driven threats, categorising their core components, methodologies, and attack vectors. Through a meticulous analysis of adversarial schemes and procedures, this foundational understanding of the threat landscape establishes the necessary groundwork for formulating a robust defensive mechanism [31,32,33,34,35].

To actively mitigate these vulnerabilities, this paper proposes a multi-layered defensive scheme tailored against ML-orchestrated attacks. Rather than evaluating semantic, application-layer transactional payloads (such as direct SQL injection or API business logic tampering), the primary contribution is a novel theoretical and empirical framework designed to secure the host- and infrastructure-level environments underpinning BI transaction platforms. The framework achieves this through a hybrid integration of ML and elliptic-curve cryptography (ECC), merging real-time anomaly detection with human–machine collaboration and mathematical mapping theory [36,37,38]. Furthermore, the architecture introduces a dynamic user authentication protocol that logs access attempts; divergent login details that do not match established profiles are immediately flagged for secondary review, enabling the rapid identification of emergent attack patterns before computational disruption propagates to active BI analytical databases. By autonomously detecting anomalies, identifying risk variables, and organising adaptive responses in real-time, the framework significantly strengthens managerial resilience against adversarial infiltrations [39,40,41,42]. Ultimately, the proposed algorithm, reinforced by a mathematical key validation technique, establishes a highly efficient and structurally verified defence strategy against sophisticated ML-driven cyber threats.

The contributions of this study are demarcated across four distinct tiers:

• Proposing a Composite Threat Score ($T_{score}$): We integrated random forest probabilities with ECC-secured integrity deviations and behavioural entropy to a single metric, revealing a holistic view of potential threats. Correlating classifier uncertainty with cryptographic and behavioural anomalies while significantly mitigating false negatives and false positives leads to improved detection capability. The $T_{score}$ enables an efficient response, identifying and mitigating cyber threats in BI-relevant settings just in time.
• Implemented and Experimentally Evaluated Components: We developed and evaluated the data preprocessing pipeline, comparative benchmarking of six machine learning classifiers, and runtime profiling metrics (latency, CPU, memory).
• Proxy-Simulated Components: We evaluated the CICEV2023 hardware execution telemetry ($cycles$, $branch$, $instructions$) and dynamic $T_{score}$ tracking across operational intervals as host-level proxies for business intelligence infrastructure disruption.
• Conceptual Production Blueprint: We proposed architectural designs for Docker edge containerisation, hardware security module (HSM) cryptographic offloading, automated MLOps continuous retraining workflows, and post-quantum key evolution.

The rest of the paper is structured as follows. Section 2 covers related works; Section 3 outlines the materials and methods; Section 4 presents the results; Section 5 provides the discussion; and Section 6 concludes the paper.

2. Related Works

Recent studies have increasingly focused on the intersection of cybersecurity architectures and AI-driven threats. For instance, Schönle and Reich [43] examined the critical role of cybersecurity frameworks in mitigating emerging AI-orchestrated attacks. Their study utilised a layered Lubric Security Score (LRS) for cross-detection; however, the findings revealed significant challenges in handling adaptive and large language model (LLM)-based cyber threats.

Investigating supervised model vulnerabilities, Anthi et al. [44] analysed adversarial learning techniques, specifically focusing on Jacobian-based saliency map attacks. Using an authentic energy systems dataset, they observed that the performance of random forest and J48 algorithms dropped by 6% and 11%, respectively, under adversarial conditions. Mohamed [1] broadened this scope by identifying various AI and machine learning (ML) methods utilised for intrusion detection, malware analysis, and risk intelligence. Based on these findings, the author proposed a scalable, secure framework designed to mitigate these emerging AI-driven threats.

To counter adversarial manipulation, Taheri et al. [45] introduced a defensive scheme that leverages generative adversarial networks (GANs) to improve model retraining. By combining a pre-trained convolutional neural network (CNN) with an external GAN, the authors created an automated pipeline that iteratively identifies deviations between adversarial and clean data, ultimately strengthening the model’s defences. Similarly, Alzaidy and Binsalleeh [46] proposed a technique for categorising Windows Portable Executables (PE) using recurrent neural networks (RNNs) and convolutional neural networks (CNNs). They generated malware-executable adversarial instances using white-box, Jacobian-based saliency, and Carlini & Wagner attacks by injecting payloads into the denial of service (DoS) header without breaking PE functionality. Their results showed that the attacks successfully bypassed the CNN with a 91% evasion rate, while the RNN was evaded 84.6% of the time.

Focusing on defensive efficiency against such adversarial inputs, Vyas and Kapadia [47] developed a scheme incorporating feature denoising blocks. Testing on ImageNet and CIFAR-10 datasets, they applied Gaussian data augmentation (GDA) and spatial smoothing (SS) against 10-iteration Projected Gradient Descent (PGD), Fast Gradient Sign Method (FGSM), and DeepFool attacks. The approach achieved an impressive 95.62% accuracy within just four minutes, outperforming existing baseline methods.

Addressing distributed denial-of-service threats in edge systems, Uddin et al. [48] demonstrated the efficacy of federated machine learning over software-defined networking. Beyond adversarial ML detection, robust cryptographic and structural protocols remain foundational. Oladipupo et al. [49] highlighted the necessity of optimising elliptic-curve cryptography (ECC) for wireless sensor networks (WSNs). By employing elliptic-curve Diffie–Hellman (ECDH) for key exchange alongside the Elliptic Curve Digital Signature Algorithm (ECDSA), their framework significantly accelerated node authentication whilst optimising power usage in multi-core environments. Moreover, Maranco et al. [29] addressed end-user security in cyber-physical systems through a multi-factor authentication (MFA) framework—integrating geolocation, one-time passwords (OTPs), and standard verification—achieving authentication accuracy rates exceeding 95.50%.

Evaluating mobile malware defence mechanisms, Bhaskar et al. [50] affirmed the necessity of integrating neural network models to secure Android environments against advanced persistent threats. Concurrently, addressing infrastructural vulnerabilities, Ali et al. [51] proposed an enhanced Vulnerability Assessment and Penetration Testing (VAPT) framework tailored for web applications deployed on Infrastructure as a Service (IaaS) cloud platforms.

As synthesised in the thematic evaluation presented in Table 1, a distinct gap persists in contemporary literature: the structural separation between robust cryptographic verification protocols and real-time machine learning anomaly detection mechanisms within business intelligence (BI) architectures. While historical studies focus heavily on standalone encryption optimisation for wireless networks or isolate deep learning frameworks within perimeter intrusion detection, few security models unify these domains explicitly to secure data-driven BI transaction platforms. This division creates a critical vulnerability, as transaction-heavy BI environments remain highly exposed to adaptive, ML-orchestrated threats capable of evading static, signature-based parameters.

Table 1. Comparative analysis of existing defence schemes against the proposed framework.

Study	Research Objectives	Methodology & Techniques	Key Results	Proposed Algorithm	Limitations
Uddin et al. [48]	Mitigate DDoS attacks in edge computing systems.	Federated learning deployed over software-defined networking (SDN).	Established a distributed ML-SDN defence architecture.	Federated ML over SDN.	Lacks empirical validation in active real-world scenarios.
Oladipupo et al. [49]	Secure wireless sensor networks (WSNs).	ECC paired with node clustering.	Accelerated execution; conserved multi-core power.	Optimised parallel ECC (ECDH/ECDSA).	Scalability constraints in large-scale WSN deployments.
Bhaskar et al. [50]	Detect and defend against mobile Android malware.	Machine learning and neural network modelling.	High accuracy in isolating Android-specific payloads.	Neural network.	Unspecified structural details of the neural network architecture.
Ali et al. [51]	Formulate a VAPT framework for AWS IaaS web applications.	Cloud-specific vulnerability assessment (VAPT).	Formulated an enhanced AWS-specific VAPT framework.	VAPT framework algorithm	Framework remains theoretically untested via simulation.
Maranco et al. [29]	Enhance cyber-physical system (CPS) end-user security.	Three-layer MFA (Geo-location, OTP, standard password).	Authentication accuracy between 95.50% and 97.50%.	Three-layer MFA.	Lacks formal verification regarding implementation challenges.
Wisdom et al. [52]	Protect Industry 4.0/5.0 human-machine interfaces.	Python-based algorithms for emerging cyber threats.	Formulated human–machine interface (HMI) data safeguarding strategies.	HMI mitigation algorithm.	Validation remains largely theoretical without empirical scaling.
Vincent & Lawal [7]	Secure the perceptual layer of electronic payment systems.	Elliptic-curve cryptography (ECC) over a binary field.	Established lightweight, low-latency encryption protocols.	Binary field ECC.	Insufficient examination of edge-case vulnerabilities.
Khan et al. [24]	Develop a scalable intrusion detection system (IDS).	Spark ML integrated with a Conv-long short time memory (LSTM) network.	Achieved 97.29% overall detection accuracy.	Two-stage anomaly and misuse IDS.	Evaluated exclusively on a single static dataset.
Reyes-Mena et al. [53]	Enhance academic computer security incident response team (CSIRT) vulnerability analysis.	Business intelligence coupled with an extract, transform, and load (ETL) process.	Facilitated early alerts; increased baseline security.	Non-standardised log ETL.	Protocol scalability remains completely unexplored.
This Study	Secure BI transactions against ML-orchestrated threats.	Hybrid ML (random forest) + ECC via mathematical mapping.	Introduced a composite threat score, 81.58% accuracy; 89.29% AUC; dynamic behavioural logging.	Adaptive ECC verification + ML anomaly detection.	Requires periodic algorithm updates and moderate computational overhead.

To address this systemic limitation, this study offers a hybrid, multi-layered defensive framework that seamlessly converges ECC with ML behavioural profiling. Backed by an autonomous, composite threat-scoring model derived from mathematical mapping theory, the proposed architecture bridges the gap between cryptographic access control and predictive intelligence. Consequently, this research provides a verified, defensive wall, with a hybrid authentication scheme that dynamically minimises detection latency and false alerts whilst maintaining high operational resilience during active business transactions.

3. Materials and Methods

This section details the development of the proposed defensive scheme designed to mitigate machine learning (ML)-orchestrated cyberattacks. The methodology integrates elliptic-curve cryptography (ECC) and ML algorithms to construct a framework for securing business intelligence (BI) transactions. The Canadian Institute for Cybersecurity DDoS Attack Dataset (CICEV2023) [54], comprising distributed denial-of-service incursions targeting cryptographic authentication protocols through credential spoofing, invalid timestamps, and volumetric resource flooding, was utilised for empirical validation. Mapping theory was subsequently applied to develop a mathematical model that optimises the defensive strategy against malicious actors, ensuring real-time threat detection and computational resilience.

3.1. Dataset Preprocessing

The CICEV2023 dataset underwent rigorous preprocessing to ensure data integrity prior to model training. Initial cleaning involved the removal of redundant data, duplicate entries, and rows containing missing columns, whilst infinite values were replaced with “NaN”. The dataset, originally sourced in JSON format, was structurally converted into a standard tabular data frame.

The experimental evaluation utilises the Canadian Institute for Cybersecurity DDoS Attack Dataset (CICEV2023), officially hosted by the University of New Brunswick. Business intelligence (BI) transaction workloads fundamentally rely on the availability and integrity of the underlying host servers that execute analytical pipelines and transactional queries. Adversarial incursions, such as credential tampering, timestamp manipulation, and authentication flooding, primarily occur at the kernel and processor execution tiers before propagating to application-layer BI databases. The CICEV2023 dataset profiles these low-level hardware performance counters (HPCs) in real-time using the Linux $perf$ subsystem, recording CPU cycles ($cycles$), branch instructions retired and predicted ($branch$), with total instructions executed ($instructions$) across simulated authentication scenarios. These microarchitectural features capture patterns of execution diversion and CPU exhaustion that directly disrupt transaction verification throughput. Consequently, while the dataset does not contain application-level business payloads (e.g., parameterised SQL queries), it serves as a verified, host-level proxy for evaluating how low-level intrusion signals can be harnessed to protect the continuity of BI infrastructure.

Categorical features were encoded, and non-informative columns were stripped to reduce dimensionality. The remaining data points—specifically focusing on CPU cycles, branch instructions, and executed instructions—were isolated and segregated into two distinct classifications: “attack” and “normal”. These classifications were subsequently merged into a unified structure comprising four primary columns: branch, $cycles$, $instructions$, and the target $label$ determining the nature of the network instance. To optimise the dataset further, an auto-encoder was trained on the training data to compute the mean squared error (MSE), facilitating the selection of an optimum threshold percentile for accurate prediction outputs. The systematic pipeline governing these initial data ingestion, structural cleaning, and classification phases is illustrated in Figure 1.

Figure 1. Operational flow diagram of the data preprocessing, dimensional filtration, and threshold determination pipeline.

3.2. Model Development and Formulation

To establish a secure transmission protocol, let $P\left(E\right)$ represent the probability of successful encryption and $P\left(D\right)$ represent the decryption probability. The secure transmission success rate, denoted as $S$, is obtained as:

$$S=P\left(E\right)·P\left(D\right)$$

In the asymmetric key validation scenario, assuming $K_{Pub}$ and $K_{Priv}$ represent a public and private key, respectively, the encryption–decryption process satisfies the following condition, where $m$ is the original message, $E$ is the encryption function, and $D$ is the decryption function:

$$D\left(K_{Priv},E\left(K_{Pub},m\right)\right)=m$$

To ensure real-time anomaly detection, resource optimisation devices with a computational capacity denoted as $C$ must process tasks $T$ requiring a time constraint $t$, expressed as:

$$C\ge {\displaystyle \frac{T}{t}}$$

In the context of detecting ML-orchestrated attacks, anomalies are identified based on the divergence between expected and observed data behaviours.

Let $X$ represent the set of features observed in the network traffic and $\hat{X}$ represent the expected features based on historical behaviour. The anomaly score, $A$, is expressed as:

$$A=\sum _{i=1}^n|X_i-{\hat{X}}_i|$$

where $n$ is the number of features, $X_i$ is the observed feature at position $i$, and ${\hat{X}}_i$ is the expected feature at position $i$. A high anomaly score triggers adaptive defensive responses based on the attack’s complexity. Let $R$ represent the response strength; the system’s response is a function of $A$:

$$R=f\left(A\right)=\{A\times \alpha , if A\ge {\theta }_1 A\times \beta , if A<{\theta }_1\}$$

where $\alpha$ and $\beta$ are constants representing differing response intensities, and ${\theta }_1$ is a predefined threshold dictating high-risk incursions.

Because the proposed scheme relies on human–machine collaboration, let $H$ represent human judgement and $M$ represent the ML decision output. The final defensive decision, $D$, is calculated as a weighted sum:

$$D=w_1·H+w_2·M$$

where $w_1$ and $w_2$ are the respective weights assigned to human and machine inputs, such that $w_1+w_2=1$.

For secure communications in BI environments, the encryption strength ($S_{enc}$) using ECC is computed based on the key space size ($N$):

$$S_{enc}=\left(N\right)$$

To operationalise these mathematical models relevant to business intelligence (BI) infrastructure, a sequential computational procedure was formulated to govern the real-time user authentication pipeline. As outlined in Algorithm 1, this defensive scheme systematically generates the encryption_key = ECC.generate_key() to secure the communication channel whilst simultaneously processing all access logs through the trained ML behavioural profile. Any login attempt that fails to match the established profile is automatically denied and flagged for secondary review, ensuring that anomalous incursions are isolated prior to system access.

Algorithm 1. Defensive Scheme

Input: access_logs (Incoming user login requests), access_patterns (Historical behavioural data)

Output: Access authorisation decision

1:    Initialise $encryption\text{\_}key\leftarrow ECC.generate\text{\_}key\left(\right)$

2:    Encrypt communication channel with $encryption\text{\_}key$

3:    for each $login\text{\_}attempt\in access\text{\_}logs$ do

4:     Set $profile\leftarrow ML.train\left(access\text{\_}patterns\right)$

5:     if $login\text{\_}attempt matches profile$ then

6:      Allow access

7:     else

8:      Flag attempt for review

9:     end if

10:    end for

The architecture dynamically evaluates user credentials. If an anomaly is detected, the system denies access, triggers a security alert, and isolates the anomaly for investigative review in the database (DB) to understand the emergent threat pattern. The comprehensive structural hierarchy and operational interface boundaries of this validation architecture are mapped out in Figure 2.

Figure 2. System layout and multi-layered authentication workflow for the hybrid ECC-ML defensive architecture.

To evaluate the defensive wall effectiveness ($E_{defence}$) against these threats, the system calculates the ratio of successfully mitigated attacks ($A_{mitigated}$) against the total detected attacks ($A_{detected}$):

$$E_{defence}={\displaystyle \frac{A_{mitigated}}{A_{detected}}}$$

For adaptive systems, the expected risk ($R_{adaptive}$) prioritises high-impact scenarios by evaluating the potential damage ($D$) and the probability of occurrence ($P$):

$$R_{adaptive}=D\times P$$

To prevent systemic bottlenecks and ensure optimal computational resilience, the load balancing factor ($\lambda$) on any given node with load $L$ and capacity $C$ is calculated as:

$$\lambda ={\displaystyle \frac{L}{C}}$$

If $\lambda >1$, the node requires offloading; if $\lambda \le 1$, it operates efficiently within its bounds.

To prepare the BI environment for post-quantum vulnerabilities, a quantum-resistant key (${\theta }_k$) and encryption function ($q_E$) are defined as:

$$q_E\left({\theta }_k,m\right)=quantum-secure ciphertext$$

To ensure the unpredictability of the defensive strategy, the encryption_key evolves randomly over time $t$, using a secure random seed ($S_t$) and a post-quantum hash function $H$ (such as the SHA-3 family):

$$K_{t+1}=H\left(K_t\oplus S_t\right)$$

The system employs Kullback–Leibler (KL) divergence ($D_{KL}$) to detect statistical divergences indicating an orchestrated ML anomaly inference attack:

$$D_{KL}\left(P_{Normal}\parallel P_{Observed}\right)>\delta$$

where $P_{Normal}$ is the expected behaviour, $P_{Observed}$ is the real-time behaviour, and $\delta$ is the threshold value. The robustness of this defence ($R_w$) is quantified by evaluating the energy complexity cost of the defence ($E_{defence}$) relative to the estimated attack exertion ($E_{attack}$):

$$R_w={\displaystyle \frac{E_{defence}}{E_{attack}}}+1$$

Values of $R_w>1$ indicate that the defensive scheme effectively overpowers the applied attack forces. This robustness is further reinforced via a hybrid quantum encryption strategy that obfuscates the ciphertext using a quantum noise mask:

$$q_E\left({\theta }_k,m\right)=En{c}_{PQC}\left(m,{\theta }_k\right)\oplus Mask\left(m\right)$$

An adaptive resilience score, $R\left(t\right)$, ensures that the defence mechanism evolves dynamically against active threats:

$$R\left(t\right)=R\left(t-1\right)+\alpha \left(\Delta E_{attack}-\Delta E_{defence}\right)$$

To compute uncertainty and detect adversarial inputs mathematically, the system computes the Shannon entropy ($U_x$) across all potential output classes ($N$):

$$U_x=-\sum _{i=1}^{N}P\left(Y_i|x\right)log log P \left(Y_i|x\right)$$

High entropy indicates high uncertainty, enabling the system to reject suspicious inputs or trigger secondary verification. Furthermore, adversarial sensitivity ($S_{adv}$) is measured using the gradient norm to identify highly susceptible regions in the input space:

$$S_{adv}\left(x\right)=\left|\right|{𝛻}_{x}L\left(f\left(x\right),y\right){\left|\right|}_2$$

where ${𝛻}_x$ represents the gradient for the input $x$, $L$ is the loss function, $f\left(x\right)$ is the model output, and $y$ is the ground truth label.

The mathematical parameters and operational thresholds across the framework were selected through a synthesis of theoretical principles and empirical tuning. Cryptographic key sizes were chosen in alignment with National Institute of Standards and Technology (NIST) recommendations to achieve high cryptographic strength while preserving computational efficiency on edge nodes. Entropy thresholds ($U_x$) and divergence boundaries ($\delta$) were derived from established uncertainty bounds in information theory, ensuring calibrated sensitivity to anomalous fluctuations without inflating false alarms. For the classification tier, random forest hyperparameters—including the number of estimators, maximum tree depth, and feature split criteria—were tuned via grid search and 5-fold cross-validation on the preprocessed CICEV2023 dataset. Experimental validation confirmed that these parameter configurations directly influenced detection robustness, with hyperparameter variations impacting accuracy, precision, recall, and the dynamic sensitivity of the composite threat score ($T_{score}$). This systematic calibration ensured that the operational thresholds remained theoretically grounded and empirically validated across both normal and compromised traffic states.

Finally, these mathematical models were unified into a central, autonomous threat assessment logic via a composite threat score ($T_{score}$):

$$T_{score}={\beta }_1{D}_{KL}+{\beta }_2{U}_x+{\beta }_3{S}_{adv}\left(x\right)+{\beta }_4\left(1-R_w\right)+{\beta }_5\left(1-R\left(t\right)\right)$$

where ${\beta }_1$ through ${\beta }_5$ are tunable weights assigned based on structural priorities. This composite score dictates the requisite protocol response (e.g., escalating security, isolating assets, or activating zero-trust verification).

To translate this mathematical threat assessment logic into an automated decision engine, the framework executes the multi-layered evaluation procedure formalised in Algorithm 2.

Algorithm 2: Composite Threat Score ($T_{score}$) Autonomous Decision Logic

Input: Access event $x$, Telemetry vector $X$, Baseline distribution $P_{Normal}$, Observed distribution $P_{Observed}$, Thresholds $\left\{T_{low},T_{mid},T_{high}\right\}$

Output: Security Action Decision

1: Extract hardware execution telemetry: $cycles,branch,instructions\leftarrow X$

2: Compute statistical divergence: $D_{KL}\leftarrow D_{KL}\left(P_{Normal}\parallel P_{Observed}\right)$

3: Compute Shannon entropy: $U_x\leftarrow -{\displaystyle {\sum }_{i=1}^N}P\left(Y_i|X\right){\log }_{2}P\left(Y_i|X\right)$

4: Compute adversarial sensitivity: $S_{adv}\leftarrow \Vert {𝛻}_X\mathcal{L}\left(f\left(X\right),y\right){\Vert }_2$

5: Obtain classifier inference: $y_{pred}\leftarrow \mathrm{RandomForest}.\mathrm{predict}\left(X\right)$

6: Calculate Composite Threat Score:

$T_{score}\leftarrow {\beta }_1{D}_{KL}+{\beta }_2{U}_x+{\beta }_3{S}_{adv}+{\beta }_4\left(1-R_w\right)+{\beta }_5\left(1-R_t\right)$

7: if $T_{score}<T_{low}$ and $y_{pred}==“\mathrm{Normal}”$ then

8:  Authorise transaction session (Standard Access Granted)

9: else if $T_{low}\le T_{score}<T_{mid}$ then

10:  Flag session for secondary verification; evaluate collaborative decision: $D=w_1·H+w_2·M$

11: else if $T_{mid}\le T_{score}<T_{high}$ then

12:  Isolate originating node; restrict database write access; sandbox process execution

13: else if $T_{score}\ge T_{high}$ then

14:  Terminate session; revoke session key; activate zero-trust cryptographic lock

15: end if

The weighting parameters (${\beta }_1$ through ${\beta }_5$) were calibrated using grid-search optimisation across validation folds to balance informational entropy with runtime stability, constrained such that ${\displaystyle {\sum }_{i=1}^5}{\beta }_i=1.0$. The calibrated parameters allocate ${\beta }_1=0.25$ ($D_{KL}$), ${\beta }_2=0.20$ ($U_x$), ${\beta }_3=0.30$ ($S_{adv}$), ${\beta }_4=0.15$ ($R_w$), and ${\beta }_5=0.10$ ($R_t$). The operational decision boundaries were established as $T_{low}=0.20$, $T_{mid}=0.35$, and $T_{high}=0.50$.

3.3. Experimental Setup

The proposed defensive framework was implemented and evaluated within a controlled virtualised environment designed to simulate active business transactions under cyberattack conditions. All computational simulations and model training phases were executed using Python 3.13 within an Anaconda Jupyter Notebook version 7.2.2 environment, utilising the Pandas and requests modules for data ingestion and structural manipulation.

To ensure rigorous evaluation and prevent model overfitting, the preprocessed CICEV2023 dataset was partitioned into a 70:30 ratio, allocating 70% of the data exclusively for model training and the remaining 30% for testing. Additionally, a 5-fold cross-validation technique was applied to assess the consistency and generalisability of the model across different subsets of the data.

During the simulation phase, the framework’s anomaly detection capability was analysed by conducting a comparative performance study across six machine learning classifiers: random forest, support vector machine (SVM), K-nearest neighbours (KNN), naive Bayes, multilayer perceptron (MLP), and decision tree. The system’s defensive resilience and operational efficacy were subsequently quantified using standard performance metrics derived from the confusion matrix. These evaluation metrics included accuracy (A), specificity (SP), precision (P), recall (R), F1-score (F1), and area under the curve (AUC), which collectively measured the model’s capacity to distinguish between legitimate operations and orchestrated network intrusions.

3.4. ECC Protocol Used

Two ECC protocols were used in the study: Elliptic Curve Diffie–Hellman (ECDH) was used for secure session establishment, safeguarding key exchange between system components while ensuring that communication channels used for model updates and entropy-based threat scoring remained confidential and resistant to adversarial interception. The ECDH efficiency enabled the prompt establishment of secure sessions without disrupting the analysis of ML behavioural threats. The Elliptic Curve Digital Signature Algorithm (ECDSA) was used for user authentication and verification. The ECDSA was applied to authenticate system components and verify the integrity of transmitted data, preventing adversaries from injecting manipulated inputs or tampered model parameters into the defensive walls.

The study provided cryptographic non-repudiation, ensuring that all communications were traced to legitimate sources. The integration of the ECC protocol complemented an entropy-driven ML threat assessment, thereby securing the system’s communication backbone. While random forest outperformed other ML classifiers after comparative evaluation against SVM, KNN, naïve Bayes, MLP, and decision trees, the ECC provided an excellent cryptographic resilience essential to safeguarding the classifier’s outputs with an important decision-making process, developing a dual-layer defensive wall with probabilistic uncertainty quantification using Shannon entropy combined with cryptographic assurance of the ECC protocols. The performance analysis demonstrated that ECC achieved strong security guarantees with reduced computational cost compared to RSA, making it suitable for adaptive, real-time environments. The synergy between ML-based detection and ECC-based protection ensured that the developed defensive walls are both analytically robust and cryptographically resilient, addressing the vulnerabilities posed by ML-orchestrated cyberattacks.

4. Results

The empirical evaluation of the proposed multi-layered defensive scheme demonstrated significant structural improvements in securing business intelligence (BI) systems against machine learning (ML)-orchestrated attacks. By integrating elliptic-curve cryptography (ECC) with dynamic ML behavioural analysis, the framework successfully established a secure data exchange environment capable of operating efficiently even under compromised network conditions. Empirical profiling of the framework within the virtualised execution environment demonstrated an average inference latency of ~12 ms per sample for the standalone random forest classifier, and ~15 ms when integrated with continuous $T_{score}$ tracking and ECC verification routines. Computational overhead remained below 5% CPU utilisation during normal baseline operations, while memory consumption remained stable at approximately 220 MB.

4.1. Empirical Evaluation of the Composite Threat Score

To empirically validate the dynamic behaviour of the composite threat score ($T_{score}$), the framework was evaluated across simulated 60-s operational intervals representing baseline authentication, active adversarial incursions, and post-mitigation stabilisation. As detailed in Table 2, during normal baseline transactions ($t$ = 0–5 s), the $T_{score}$ remained stable within the baseline threshold range (0.20–0.24), reflecting minimal informational divergence ($D_{KL}$) and low Shannon entropy ($U_x$). During active attack intervals ($t$ = 6–30 s)—encompassing credential manipulation (Wrong EV ID), timestamp tampering, and authentication flooding—the $T_{score}$ elevated sharply above the alert threshold ($T_{mid}>0.35$), reaching peak values between $0.56$ and $0.60$. This sustained elevation activated automated quarantine protocols and node isolation. Following ECC-based cryptographic moderation and session containment ($t$ = 31–60 s), the $T_{score}$ declined steadily, returning to baseline stabilisation (0.20–0.23) by $t=50\mathrm{s}$.

Table 2. Quantitative evolution of $T_{score}$ across the simulated operational attack and mitigation intervals.

Time Interval (s)	Wrong EV ID	Wrong EV Timestamp	Wrong CS Timestamp	False Authentication	Post-Mitigation ${\mathit{T}}_{\mathit{s}\mathit{c}\mathit{o}\mathit{r}\mathit{e}}$ (ECC-Stabilised)	Observed Operational Behaviour
0–5	0.22	0.23	0.21	0.24	0.20	Normal baseline authentication traffic.
6–10	0.36	0.38	0.37	0.39	0.28	Initial anomaly detection (ID/timestamp skew).
11–15	0.42	0.44	0.43	0.45	0.31	Authentication failures escalate; $S_{adv}$ increases.
16–20	0.48	0.50	0.49	0.51	0.33	System overhead rises; resilience mechanisms engaged.
21–25	0.53	0.55	0.54	0.56	0.34	Peak attack pressure; entropy divergence exceeds bound.
26–30	0.57	0.59	0.58	0.60	0.35	Critical threshold exceeded; ECC containment triggered.
31–35	0.46	0.47	0.45	0.48	0.30	Post-mitigation recovery; threat score begins decline.
36–40	0.39	0.40	0.38	0.41	0.27	Anomalous sessions blocked; system stabilizes.
41–45	0.33	0.34	0.32	0.35	0.25	Telemetry returns toward baseline; entropy normalizes.
46–50	0.28	0.29	0.27	0.30	0.23	Recovery phase; baseline equilibrium re-established.
51–55	0.24	0.25	0.23	0.26	0.21	Stable operational state; minimal residual variance.
56–60	0.21	0.22	0.20	0.23	0.20	Baseline fully restored; authenticated access active.

4.2. Authentication Workflow and Feature Distribution

The system’s primary defence mechanism is rooted in its dual-authentication architecture. As visualised in Figure 3, the protocol simultaneously processes user login requests through an ECC cryptographic challenge and an ML-driven behavioural analysis model. Access is strictly granted only when both the cryptographic verification and the behavioural score successfully pass; a failure in either node results in immediate access denial and the logging of the anomaly.

Figure 3. Developed defensive scheme user authentication procedure outlining the dual ECC and ML verification workflow.

Prior to classification, the CICEV2023 dataset features were analysed to ascertain the variance between “attack” and “normal” instances. The feature distribution histograms detailed in Figure 4 illustrate distinct frequency separations across (a) CPU cycles, (b) branch instructions, and (c) executed instructions, confirming the viability of these parameters for training the classification models.

Figure 4. Feature distribution histograms plotting the frequency between normal and attack classes for (a) CPU cycles, (b) branch instructions, and (c) total executed instructions.

Furthermore, a correlation matrix (Figure 5) mapped the relationships between these variables. The observed correlations (e.g., −0.44 between cycles and instructions) verified the absence of extreme multicollinearity, ensuring that the model would not suffer from redundant feature overfitting.

Figure 5. Correlation matrix illustrating the linear relationships between cycles, branches, and instructions.

4.3. Model Evaluation and Cross-Validation

The predictive performance of the random forest classifier, trained on a 70:30 data split, was comprehensively evaluated. The confusion matrix (Figure 6) detailing the feature prediction breakdown recorded 126 true negatives (correctly identified normal traffic) and 60 true positives (correctly identified attacks), against 15 false positives and 27 false negatives.

Figure 6. Confusion matrix for ML attack detection demonstrating the classification of true/false positives and negatives.

The overall predictive capabilities of the model for both classes are summarised in Figure 7 and Table 3. The random forest model achieved a macro-average precision of 0.8118 and a macro-average recall of 0.7916 across a total support volume of 228 instances. The model demonstrated a slightly higher proficiency in classifying “Normal” instances (F1-score: 0.8571) compared to “Attack” instances (F1-score: 0.7407).

Figure 7. Class-wise distribution of predictive evaluation metrics (precision, recall, F1-score, accuracy, and AUC).

Table 3. Precision, recall, F1-score, and support metrics for the random forest classifier.

Class	Precision	Recall	F1-Score	Support
Normal	0.8235	0.8936	0.8571	141
Attack	0.8000	0.6897	0.7407	87
Accuracy	0.8158	-	-	228
Macro Avg	0.8118	0.7916	0.7989	228
Weighted Avg	0.8146	0.8158	0.8127	228

To evaluate the model’s capacity to distinguish true attacks whilst minimising false alarms, classification curves were plotted in Figure 8. The receiver operating characteristic (ROC) curve (Figure 8a) yielded an area under the curve (AUC) of 0.89, indicating a strong capability to separate the classes across threshold variances. The precision–recall (PR) curve (Figure 8b) reinforced this, recording an average precision of 0.8282.

Figure 8. Classification performance curves illustrating (a) the ROC curve plotting the true positive rate against the false positive rate (AUC = 0.89), and (b) the precision–recall (PR) curve (avg precision = 0.8282).

To ensure the model’s generalizability and verify that the metrics were not overly reliant on a specific data subset, a 5-fold cross-validation was executed. The composite line graphs for accuracy and precision (Figure 9) alongside recall and F1-score (Figure 10) exhibited high stability across all five validation folds, confirming the structural reliability of the deployed algorithm.

Figure 9. Line graphs plotting the consistency of (a) accuracy and (b) precision across the 5-fold cross-validation splits.

Figure 10. Line graphs plotting the consistency of (a) recall and (b) F1-score across the 5-fold cross-validation splits.

4.4. Comparative Analysis of Machine Learning Classifiers

To validate the selection of the random forest algorithm for the defensive architecture, its performance was benchmarked against five alternative ML classifiers: support vector machine (SVM), K-nearest neighbours (KNN), naive Bayes, multilayer perceptron (MLP), and decision tree.

As detailed in Table 4, the random forest classifier outperformed all comparative models, achieving the highest overall accuracy (81.58%) and the highest AUC (89.29%). While SVM recorded a 100.00% specificity, it failed to compute balanced sensitivity or precision parameters, resulting in the lowest overall accuracy (61.84%). KNN and decision tree models offered competitive accuracies (80.70% and 79.38%, respectively), but fell short of the robust metric thresholds established by the random forest model.

Table 4. Comparative percentage analysis of the six evaluated machine learning algorithms.

Classifier	Accuracy	Sensitivity	Specificity	Precision	Recall	F1-Score	AUC
Random Forest	81.58	68.97	89.36	80.00	68.97	74.07	89.29
KNN	80.70	66.67	89.36	79.45	66.67	72.50	85.57
Decision Tree	79.38	66.66	87.23	76.32	66.67	71.17	76.95
MLP	78.50	63.21	87.94	76.39	63.22	69.18	85.47
Naive Bayes	71.05	48.28	85.11	66.67	48.28	56.00	79.95
SVM	61.84	-	100.00	-	-	-	84.44

Consequently, despite necessitating periodic algorithmic updates and introducing a moderate computational overhead to the BI edge infrastructure, the random forest integrated ECC architecture provided the most resilient multi-layered defence scheme for threat detection.

5. Discussion

This research examined the trajectory of emerging cyberattacks to develop a proactive, multi-layered defence scheme capable of mitigating persistent, machine learning (ML)-orchestrated threats within business intelligence (BI) infrastructures. By integrating elliptic-curve cryptography (ECC) with ML anomaly detection techniques, the study formulated a novel theoretical framework designed to secure sensitive BI transactions against adversaries who utilise advanced ML to bypass traditional security signatures.

The empirical evaluation of the proposed user authentication and authorisation architecture demonstrated measurable operational improvements across host-level infrastructure proxies. Benchmarking the Canadian Institute for Cybersecurity DDoS Attack Dataset (CICEV2023) for intrusion detection, the random forest classifier significantly outperformed comparative baseline models. The model achieved a specificity of 89.36%, measuring its robust capacity to accurately classify negative (normal) cases and avoid triggering false security alarms. Furthermore, a precision score of 80.00% established that when the model flagged an anomaly as an attack, the prediction was highly accurate, thereby preventing unnecessary disruption to legitimate business transactions.

The area under the curve (AUC) metric of 89.29% further confirmed the model’s structural ability to effectively distinguish between orchestrated attacks and normal network behaviour across various thresholds. Ultimately, by recording system logs after each login attempt and mathematically comparing them against established profiles, the architecture successfully created a dynamic environment where divergent access patterns were immediately flagged, isolated, and reviewed.

In the context of mission-critical business intelligence (BI) transactions, an error margin of approximately 18% to 20% (reflecting 81.58% accuracy and 80.00% precision) warrants rigorous operational scrutiny. A granular examination of the test partition confusion matrix (Figure 6) revealed 15 false positives and 27 false negatives out of 228 total instances ($TN=126, FP=15, FN=27, TP=60$). An attack recall of 68.97% indicates that 27 out of 87 malicious instances bypassed the isolated classification boundary. Analysis of these 27 false negatives demonstrates that they correspond to low-intensity execution traces in which branch redirections and CPU cycle consumption closely mirror normal operational distributions, thereby evading static decision trees. Within the proposed architecture, this classification limitation is mitigated by the continuous, entropy-driven composite threat score ($T_{score}$) formalised in Algorithm 2. Because persistent adversarial incursions require iterative execution attempts, cumulative instruction anomalies induce measurable shifts in relative Shannon entropy ($U_x$) and statistical divergence ($D_{KL}$). As demonstrated in the temporal evaluation of Table 2, sustained probing elevates the $T_{score}$ above the operational alert threshold ($T_{score}\ge 0.35$), triggering asset isolation and process sandboxing even when an individual instance is misclassified by the initial random forest pass. Conversely, the 15 false-positive predictions (normal sessions mislabelled as attacks) do not result in dropped transactions or service disruptions. Instead, sessions falling into the alert boundary ($0.20\le T_{score}<0.35$) are routed to quarantine, where secondary collaborative arbitration ($D=w_1·H+w_2·M$) and ECC cryptographic re-authentication permit legitimate users to validate access transparently. Throughout this quarantine verification, data in transit remain protected by the active ECDH session key, ensuring that transactional integrity is maintained without exposing backend BI databases to unverified requests.

Thus, the hybridisation was designed to overcome ECC’s traditional limitations, such as vulnerability to side channel attacks and latency during ECC. generation_key(), by embedding an ML-driven adaptive mechanism that dynamically tunes cryptographic parameters in response to data behaviour, user patterns, and detected threats. The ECC’s strength lies in its resistance to brute-force attacks, for example, breaking a 256-bit ECC key requires ≈2¹²⁸ operations, but it cannot detect impersonation if keys are stolen, thus the need for the ML behavioural analysis counterbalancing ECC drawback while collectively providing dual user verification and authentication with superior threat analysis, efficiently mitigating cyber threats just in time.

5.1. Comparative Analysis with Baseline Studies

When benchmarked against contemporary cybersecurity frameworks, the proposed hybrid architecture demonstrates a strategic pivot from isolated deep learning models to holistic, cryptographically secured edge defences. The random forest-ECC model achieved an overall accuracy of 81.58% and an AUC of 89.29%. While standalone deep learning models, such as the Conv-LSTM network developed by Khan et al. [24] and the feature denoising architecture proposed by Vyas and Kapadia [47], reported higher absolute accuracies exceeding 95%, these models were evaluated in largely static or offline environments. The proposed framework deliberately trades marginal raw accuracy for highly robust cryptographic verification and real-time adaptability, addressing the specific operational demands of active BI transactions.

Furthermore, the vulnerability of static architectures to adversarial manipulation is well-documented. Alzaidy and Binsalleeh [46] demonstrated that conventional CNN and RNN architectures suffered evasion rates between 84.6% and 91% when subjected to Jacobian-based saliency and Carlini & Wagner attacks. The double-walled architecture proposed in this study inherently mitigates such evasion tactics by enforcing immediate ECC cryptographic denial before adversarial anomalies can fully probe or exploit the ML behavioural layer.

In the context of access control, Maranco et al. [29] achieved between 95.50% and 97.50% authentication accuracy using a three-layer multi-factor authentication (MFA) system. The proposed scheme extends this foundational concept; rather than relying solely on static OTPs or geolocation, it dynamically updates access profiles via Kullback–Leibler divergence computations, effectively reducing detection latency against orchestrated incursions without requiring constant user intervention.

5.2. Limitations of the Proposed Scheme

Despite the robust predictive and cryptographic performance of the hybrid ECC-ML framework, several structural limitations must be acknowledged:

• Computational Overhead: The continuous mathematical encryption and decryption of BI transactions using ECC, coupled with real-time ML behavioural profiling, introduces a moderate computational overhead. This presents a specific challenge for resource-constrained edge devices operating within the network architecture.
• Algorithmic Obsolescence: Because ML-orchestrated attacks are inherently adaptive, the defensive ML models (such as the deployed random forest classifier) require constant algorithmic updates and retraining to recognise novel, emergent attack vectors effectively.
• Dataset Dependency and Transactional Scope: While low-level execution telemetry (CPU cycles, branch instructions, and total executed instructions) from the CICEV2023 dataset effectively captures the microarchitectural disruption of host servers, this evaluation operates at the infrastructure level rather than the application transactional layer. The framework benchmarks computational resource exhaustion and execution hijacking that undermine underlying business intelligence (BI) hosting platforms; it does not evaluate semantic application-tier payloads, such as parameterised SQL injections, malicious OLAP queries, or API business-logic tampering. Consequently, the empirical results validate infrastructure-tier anomaly mitigation that safeguards BI operational availability and processing throughput, functioning as an indirect proxy, rather than a direct semantic validation of business transaction records.

5.3. Recommendations for Future Work

Based on the insights gained during the architectural development and simulation phases, the following recommendations are proposed:

• Human–Machine Collaboration: Future security deployments should strictly integrate human intelligence with automated ML strategies. This collaborative approach is critical for interpreting highly nuanced attack patterns and ensuring ethical, context-aware decision-making when isolating critical BI assets.
• Live Network Topologies: Subsequent research must migrate testing from virtualised, controlled environments to live, large-scale BI network infrastructures to evaluate the protocol’s load-balancing capabilities and latency under real-world transaction volumes.
• Quantum-Resistant Scaling: As adversarial capabilities evolve, the mathematical mapping theory underpinning the encryption_key generation should be further explored and scaled to fully encompass post-quantum cryptographic standards.
• Conceptual Production Architecture Blueprint and MLOps: While the empirical validation in this study was benchmarked within a controlled, virtualised simulation environment, operationalising the hybrid framework across enterprise infrastructures requires addressing edge distribution and runtime maintenance. The design is proposed as a conceptual architectural blueprint rather than an experimentally deployed deliverable. In practical operational environments, the hybrid ECC-ML pipeline can be encapsulated into lightweight microservices using containerisation platforms such as Docker, allowing seamless distribution across distributed business intelligence (BI) edge nodes without environment-specific dependencies. To manage computational constraints on edge devices, cryptographic routines (ECDH and ECDSA) can be offloaded to dedicated cryptographic accelerators or Hardware security modules (HSMs). Furthermore, to counteract algorithmic obsolescence, production deployments should incorporate an automated MLOps continuous retraining workflow. Under this architecture, anonymised access telemetry and flagged high-entropy anomalies would be transmitted asynchronously to a central staging repository, triggering model retraining whenever the composite threat score ($T_{score}$) or feature distributions exhibit significant drift, thereby updating edge models without disrupting active transaction processing.

6. Conclusions

The advancement of machine learning (ML) operations has concurrently ushered in an era of highly sophisticated, ML-orchestrated cyberattacks. These adversarial threats deliberately bypass traditional security parameters by leveraging data manipulation and coordinated automation, necessitating advanced defensive strategies to secure data-driven business intelligence (BI) systems. This research developed a novel, proactive framework for securing BI transactions through the hybrid integration of elliptic-curve cryptography (ECC) and ML predictive analysis.

The study designed a comprehensive user authentication architecture that rigorously validates credentials via mathematical mapping theory and behavioural profiling. By deploying the scheme on the Canadian Institute for Cybersecurity DDoS Attack Dataset (CICEV2023) within a controlled, virtualised environment, the framework successfully executed real-time anomaly detection and adaptive threat isolation. Out of the six ML algorithms tested using a 70:30 training and testing split, the random forest classifier delivered the most resilient performance, achieving 81.58% accuracy, 89.36% specificity, 80.00% precision, 68.97% recall, an F1-score of 74.07%, and an AUC of 89.29%.

Ultimately, the proposed hybrid scheme achieved robust user authentication, unified ML-based threat detection with cryptographic intelligence, and demonstrated superior performance in safeguarding data confidentiality. The study introduced a threat score ($T_{score}$) with normal and active attack strategies. During normal traffic, the baseline remains stable and low, while during active adversarial authentication incursion (including credential spoofing, timestamp manipulation, and authentication flooding), it rises sharply, reflecting increased uncertainties and risks. Once the ECC-secured communication protocol mitigates the threats, the $T_{score}$ stabilises, confirming the defensive walls’ efficiency in dynamically linking the breaches between the theoretical model and practical results. While random forest provided strong classification, the $T_{score}$ acted as the meta-layer, computing the variant evolving cyber-threats, using dual user authentication and validation, ensuring that the developed mathematical framework was directly tied to empirical outcomes, as compared to the $T_{score}$ values with random forest metrics. Significantly bridging the structural gap between cryptographic access control and autonomous anomaly detection, this framework equips contemporary organisations with an efficient, multi-layered defensive wall against the evolving landscape of sophisticated cyber threats.