Effectiveness and Limits of Artificial Intelligence in Cyber Defense: Analysis of Model Classes and Practical Experience in Developing a Hybrid Antivirus Solution
Year: 2026
Type: article
Abstract: Purpose: to analyze the feasibility of applying different classes of artificial intelligence models (classical machine learning, deep learning, large language models) to cyber defense tasks, to determine the functional areas each class is responsible for within a hybrid threat detection system, and to assess the limits of their effectiveness based on experience developing the AI FileGuard hybrid solution. Method: an analytical review of publications and industry reports (2017-2026) combined with a reflective analysis of the authors’ own prototype, complemented by reproducible quantitative testing of the static layers (signature-based and heuristic) on a labelled dataset of 1195 files (903 in the PE subset); the LLM layer was left outside the current measurement. Findings: classical machine learning on structured features remains a competitive or superior baseline for static analysis of PE files, while large language models are effective only as an interpretation and analyst-support layer, not as an independent detector. The as-shipped configuration yields FPR = 100%; PE heuristic yields 61% recall at 5% FPR; classical ML reaches 94.5% recall at 3.3% FPR (AUC = 0.992). Criteria for distributing cyber defense functions among AI model classes are systematized and aligned with NIST AI RMF and MITRE ATLAS, supporting hybrid threat-detection system design.
Source: Komp'ûternì sistemi ta merežì
Authors: N. R. Dzianyi, O. O. Mokryy
Institution: Lviv Polytechnic National University
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7225816998