Abstract
Zero-day attack takes advantage of unknown vulnerability to evade traditional signature-based detection systems. We introduced a novel multi-layered machine learning (ML) framework which we call zeroHunter. The framework integrates cross-layer detection techniques and adversarial hardening. The layers of detection are the network layer which used the spatio-temporal Graph Neural Network (GNN) to analyze traffic graph, the host layer which uses bio-optimized LightGBM with SHAP for explainability, and the memory layer which uses contractive autoencoder and CNN for forensic analysis. Adversarial hardening was implemented with feature-space randomization and defensive distillation. The models are updated in real-time via online learning module (River ML) thereby forming a close-loop mitigation system. The models were trained with hybrid datasets (CIC-IDS2023, IoT-23, and synthetic zero-day data generated with WGAN). The evaluations were done using MITRE CALDERA simulation of Zero-day Detection Rate, CLEVER robustness scoring, and mitigation latency benchmarks. The results show 86.4% of zero-day detection rate which is higher than Elastic EDR (Endpoint Detection and Response), 0.76 CLEVER score and mitigation time of less than 500ms which is 26% - 38% faster than commercial EDR. These results show that zeroHunter, leveraging ML can effectively detect unknown threat and respond in real-time.