A Scalable AI-Driven Framework for Cybersecurity Training Simulator with Live Network Traffic Visualization ↔ Next-Gen AI Cybersecurity Simulator with Real-Time Network Intelligence and Threat Visualization

PARAGRAPH B¶8-13

interactive, controllable, and visually intuitive platform that can simulate network attacks and demonstrate real-time monitoring and detection processes. Figure 1: Cybersecurity Simulator Without such a simulator, security professionals and trainees struggle to bridge the gap between theoretical knowledge and practical understanding of network anomaly detection, hindering their ability to effectively recognize and respond to dynamic security incidents. The motivation stems from the critical need for effective and practical cybersecurity training that reflects real-world network dynamics. By integrating a network simulation with a data processing framework like MapReduce, this research aims to demystify how large volumes of network traffic are analyzed for security breaches. This allows trainees to actively participate in generating "attack" traffic (e.g., large file transfers exceeding a threshold) and immediately witness its impact on the system's "attack packets" counter and the dashboard. This hands-on, cause-and-effect learning accelerates the development of crucial analytical and monitoring skills required in a security operations center (SOC). 2. LITERATURE SURVEY Chowdhury and Gkioulos [1] identified simulation systems positioned between CRs and TTXs. They grouped these systems into two categories based on their applicability to management training. The first includes tools oriented toward strategic planning or investment decisions. while Holik et al. [2] emulated communication in digital substations for operator training. These methods focus on technical realism. In contrast, our approach is designed for management-level participants and focuses on decision-making rather than technical replication, enabling efficient and scalable training without requiring infrastructure models or deep technical knowledge. Ukwandu et al. [3] developed a taxonomy identifying seven participant team types, highlighting the diversity of roles in cyber exercises. These classifications underscore the complexity of CR exercises. Ostby et al. [4] addressed the importance of support roles, while Granåsen and Andersson [5] proposed performance metrics to assess exercise effectiveness. Turning to wargaming, Johnson [6] identifies four levels: tactical, command–tactical, operational, and strategic. At the tactical and command–tactical levels, wargames involve fine-grained detail and simulate concrete actions. In cyber exercises, this corresponds to tasks typically conducted in CRs or testbeds. Perla [7] distinguished wargames from TTXs by noting their outcome-driven progression. Our method applies this principle by updating the scenario based on participant decisions. Military wargames often explore cyber operations within a broader context but rarely address organization-level incident management. Švábenský [8] proposed combining CRs with serious games, which use game-based mechanics to enhance engagement and learning outcomes in non-entertainment contexts. Mihm et al. [9], the civilian organizational hierarchy is generally structured as follows, from lowest to highest: front-line problem-solving workers, front-line management, middle management, and top management. From a national and military perspective, the hierarchy consists of national strategic, military strategic, operational, and tactical levels. The national strategic level defines long-term national goals and provides the overarching context for civilian and military operations. Panda et al. [10] used the naive Bayes classifier from the Weka package and KDD’99 data for training and testing. Data were grouped into the four attack types (probe and scan, DoS, U2R and R2L) and their classifier achieved 96%, 99%, 90% and 90% testing accuracy, respectively. The cumulative false positive rate was 3%. Amor et al. [11] developed a framework using a simple form of Bayesian network using the KDD’99 data and used categories to depict different attack scenarios. Solving an anomaly detection problem, the reported results were 97%, 96%, 9%, 12% and 88% accuracy for normal, DoS, R2L, U2R and probe or scan categories, respectively.

PARAGRAPH B¶11-15

Ostby et al. [4] addressed the importance of support roles, while Granåsen and Andersson [5] proposed performance metrics to assess exercise effectiveness. Turning to wargaming, Johnson [6] identifies four levels: tactical, command–tactical, operational, and strategic. At the tactical and command–tactical levels, wargames involve fine-grained detail and simulate concrete actions. In cyber exercises, this corresponds to tasks typically conducted in CRs or testbeds. Perla [7] distinguished wargames from TTXs by noting their outcome-driven progression. Our method applies this principle by updating the scenario based on participant decisions. Military wargames often explore cyber operations within a broader context but rarely address organization-level incident management. Švábenský [8] proposed combining CRs with serious games, which use game-based mechanics to enhance engagement and learning outcomes in non-entertainment contexts. Mihm et al. [9], the civilian organizational hierarchy is generally structured as follows, from lowest to highest: front-line problem-solving workers, front-line management, middle management, and top management. From a national and military perspective, the hierarchy consists of national strategic, military strategic, operational, and tactical levels. The national strategic level defines long-term national goals and provides the overarching context for civilian and military operations. Panda et al. [10] used the naive Bayes classifier from the Weka package and KDD’99 data for training and testing. Data were grouped into the four attack types (probe and scan, DoS, U2R and R2L) and their classifier achieved 96%, 99%, 90% and 90% testing accuracy, respectively. The cumulative false positive rate was 3%. Amor et al. [11] developed a framework using a simple form of Bayesian network using the KDD’99 data and used categories to depict different attack scenarios. Solving an anomaly detection problem, the reported results were 97%, 96%, 9%, 12% and 88% accuracy for normal, DoS, R2L, U2R and probe or scan categories, respectively. Kokila et al. [12], the authors used an SVM classifier to detect DDoS attacks in a software-defined network. Experiments were conducted on the DARPA dataset, comparing the SVM classifier with other standard classification techniques. Although the classifier had higher accuracy, the SVM took more time, which is an obvious flaw. Amiri et al. [13], the authors used a least-squares SVM to decrease the training time on large datasets. Using three different feature extraction algorithms, they reduced the number of features from 41 to 19. The data were resampled to have around 7000 instances for each of the five classes of the KDD’99 dataset. The classification was reported at 99% for DoS, probe or scan, R2L and normal classes and 93% for U2R. Hu, et al. [14] utilized a robust SVM, which is a variation of SVM where the discriminating hyperplane is averaged to be smoother and the regularization parameter is automatically determined. Preprocessing training and testing of data was done on the Basic Security Module from the DARPA 1998 dataset. It showed 75% accuracy with no false positives and 100% accuracy with 3% false positives. Vuong et al. [15], the authors utilized decision trees to generate detection rules against denial-of-service and command injection attacks on robotic vehicles. Results showed that different attacks had different impacts on robotic behavior

PARAGRAPH B¶12-16

Mihm et al. [9], the civilian organizational hierarchy is generally structured as follows, from lowest to highest: front-line problem-solving workers, front-line management, middle management, and top management. From a national and military perspective, the hierarchy consists of national strategic, military strategic, operational, and tactical levels. The national strategic level defines long-term national goals and provides the overarching context for civilian and military operations. Panda et al. [10] used the naive Bayes classifier from the Weka package and KDD’99 data for training and testing. Data were grouped into the four attack types (probe and scan, DoS, U2R and R2L) and their classifier achieved 96%, 99%, 90% and 90% testing accuracy, respectively. The cumulative false positive rate was 3%. Amor et al. [11] developed a framework using a simple form of Bayesian network using the KDD’99 data and used categories to depict different attack scenarios. Solving an anomaly detection problem, the reported results were 97%, 96%, 9%, 12% and 88% accuracy for normal, DoS, R2L, U2R and probe or scan categories, respectively. Kokila et al. [12], the authors used an SVM classifier to detect DDoS attacks in a software-defined network. Experiments were conducted on the DARPA dataset, comparing the SVM classifier with other standard classification techniques. Although the classifier had higher accuracy, the SVM took more time, which is an obvious flaw. Amiri et al. [13], the authors used a least-squares SVM to decrease the training time on large datasets. Using three different feature extraction algorithms, they reduced the number of features from 41 to 19. The data were resampled to have around 7000 instances for each of the five classes of the KDD’99 dataset. The classification was reported at 99% for DoS, probe or scan, R2L and normal classes and 93% for U2R. Hu, et al. [14] utilized a robust SVM, which is a variation of SVM where the discriminating hyperplane is averaged to be smoother and the regularization parameter is automatically determined. Preprocessing training and testing of data was done on the Basic Security Module from the DARPA 1998 dataset. It showed 75% accuracy with no false positives and 100% accuracy with 3% false positives. Vuong et al. [15], the authors utilized decision trees to generate detection rules against denial-of-service and command injection attacks on robotic vehicles. Results showed that different attacks had different impacts on robotic behavior 3. PROPOSED SYSTEM The proposed system operates through a sequence of interconnected steps involving simulation, distributed processing, anomaly detection, and visualization. The proposed system integrates a network simulation layer with a MapReduce-based anomaly detection engine to provide a real-time monitoring dashboard. Users simulate file transfers on a network (Port 3333), generating traffic data that is independently analyzed by the Network Monitor (Port 4444). The core logic, simulated via MapReduce, classifies packets as normal or attack based on a size-based heuristic (e.g., MB), instantly updating internal counters as demonstrate in Figure 2. The results are immediately visualized on a JFreeChart Dashboard, offering trainees a direct, real-time understanding of how distributed processing and simple AI rules can detect and respond to network anomalies.

PARAGRAPH B¶12-16

Mihm et al. [9], the civilian organizational hierarchy is generally structured as follows, from lowest to highest: front-line problem-solving workers, front-line management, middle management, and top management. From a national and military perspective, the hierarchy consists of national strategic, military strategic, operational, and tactical levels. The national strategic level defines long-term national goals and provides the overarching context for civilian and military operations. Panda et al. [10] used the naive Bayes classifier from the Weka package and KDD’99 data for training and testing. Data were grouped into the four attack types (probe and scan, DoS, U2R and R2L) and their classifier achieved 96%, 99%, 90% and 90% testing accuracy, respectively. The cumulative false positive rate was 3%. Amor et al. [11] developed a framework using a simple form of Bayesian network using the KDD’99 data and used categories to depict different attack scenarios. Solving an anomaly detection problem, the reported results were 97%, 96%, 9%, 12% and 88% accuracy for normal, DoS, R2L, U2R and probe or scan categories, respectively. Kokila et al. [12], the authors used an SVM classifier to detect DDoS attacks in a software-defined network. Experiments were conducted on the DARPA dataset, comparing the SVM classifier with other standard classification techniques. Although the classifier had higher accuracy, the SVM took more time, which is an obvious flaw. Amiri et al. [13], the authors used a least-squares SVM to decrease the training time on large datasets. Using three different feature extraction algorithms, they reduced the number of features from 41 to 19. The data were resampled to have around 7000 instances for each of the five classes of the KDD’99 dataset. The classification was reported at 99% for DoS, probe or scan, R2L and normal classes and 93% for U2R. Hu, et al. [14] utilized a robust SVM, which is a variation of SVM where the discriminating hyperplane is averaged to be smoother and the regularization parameter is automatically determined. Preprocessing training and testing of data was done on the Basic Security Module from the DARPA 1998 dataset. It showed 75% accuracy with no false positives and 100% accuracy with 3% false positives. Vuong et al. [15], the authors utilized decision trees to generate detection rules against denial-of-service and command injection attacks on robotic vehicles. Results showed that different attacks had different impacts on robotic behavior 3. PROPOSED SYSTEM The proposed system operates through a sequence of interconnected steps involving simulation, distributed processing, anomaly detection, and visualization. The proposed system integrates a network simulation layer with a MapReduce-based anomaly detection engine to provide a real-time monitoring dashboard. Users simulate file transfers on a network (Port 3333), generating traffic data that is independently analyzed by the Network Monitor (Port 4444). The core logic, simulated via MapReduce, classifies packets as normal or attack based on a size-based heuristic (e.g., MB), instantly updating internal counters as demonstrate in Figure 2. The results are immediately visualized on a JFreeChart Dashboard, offering trainees a direct, real-time understanding of how distributed processing and simple AI rules can detect and respond to network anomalies.

PARAGRAPH B¶13-17

Mihm et al. [9], the civilian organizational hierarchy is generally structured as follows, from lowest to highest: front-line problem-solving workers, front-line management, middle management, and top management. From a national and military perspective, the hierarchy consists of national strategic, military strategic, operational, and tactical levels. The national strategic level defines long-term national goals and provides the overarching context for civilian and military operations. Panda et al. [10] used the naive Bayes classifier from the Weka package and KDD’99 data for training and testing. Data were grouped into the four attack types (probe and scan, DoS, U2R and R2L) and their classifier achieved 96%, 99%, 90% and 90% testing accuracy, respectively. The cumulative false positive rate was 3%. Amor et al. [11] developed a framework using a simple form of Bayesian network using the KDD’99 data and used categories to depict different attack scenarios. Solving an anomaly detection problem, the reported results were 97%, 96%, 9%, 12% and 88% accuracy for normal, DoS, R2L, U2R and probe or scan categories, respectively. Kokila et al. [12], the authors used an SVM classifier to detect DDoS attacks in a software-defined network. Experiments were conducted on the DARPA dataset, comparing the SVM classifier with other standard classification techniques. Although the classifier had higher accuracy, the SVM took more time, which is an obvious flaw. Amiri et al. [13], the authors used a least-squares SVM to decrease the training time on large datasets. Using three different feature extraction algorithms, they reduced the number of features from 41 to 19. The data were resampled to have around 7000 instances for each of the five classes of the KDD’99 dataset. The classification was reported at 99% for DoS, probe or scan, R2L and normal classes and 93% for U2R. Hu, et al. [14] utilized a robust SVM, which is a variation of SVM where the discriminating hyperplane is averaged to be smoother and the regularization parameter is automatically determined. Preprocessing training and testing of data was done on the Basic Security Module from the DARPA 1998 dataset. It showed 75% accuracy with no false positives and 100% accuracy with 3% false positives. Vuong et al. [15], the authors utilized decision trees to generate detection rules against denial-of-service and command injection attacks on robotic vehicles. Results showed that different attacks had different impacts on robotic behavior 3. PROPOSED SYSTEM The proposed system operates through a sequence of interconnected steps involving simulation, distributed processing, anomaly detection, and visualization. The proposed system integrates a network simulation layer with a MapReduce-based anomaly detection engine to provide a real-time monitoring dashboard. Users simulate file transfers on a network (Port 3333), generating traffic data that is independently analyzed by the Network Monitor (Port 4444). The core logic, simulated via MapReduce, classifies packets as normal or attack based on a size-based heuristic (e.g., MB), instantly updating internal counters as demonstrate in Figure 2. The results are immediately visualized on a JFreeChart Dashboard, offering trainees a direct, real-time understanding of how distributed processing and simple AI rules can detect and respond to network anomalies. 1. Network Simulation and Data Generation: The process begins with the Main and Network classes providing a graphical user interface where a user configures a network with simulated users. The user then initiates a file transfer (upload or download) via the Network class, selecting a file size and a simulated user ID. This action triggers two key concurrent processes: the file transfer itself handled by the Server (Port 3333) and the generation of network traffic data representing the file size, which is sent to the monitoring component.

PARAGRAPH B¶13-18

Mihm et al. [9], the civilian organizational hierarchy is generally structured as follows, from lowest to highest: front-line problem-solving workers, front-line management, middle management, and top management. From a national and military perspective, the hierarchy consists of national strategic, military strategic, operational, and tactical levels. The national strategic level defines long-term national goals and provides the overarching context for civilian and military operations. Panda et al. [10] used the naive Bayes classifier from the Weka package and KDD’99 data for training and testing. Data were grouped into the four attack types (probe and scan, DoS, U2R and R2L) and their classifier achieved 96%, 99%, 90% and 90% testing accuracy, respectively. The cumulative false positive rate was 3%. Amor et al. [11] developed a framework using a simple form of Bayesian network using the KDD’99 data and used categories to depict different attack scenarios. Solving an anomaly detection problem, the reported results were 97%, 96%, 9%, 12% and 88% accuracy for normal, DoS, R2L, U2R and probe or scan categories, respectively. Kokila et al. [12], the authors used an SVM classifier to detect DDoS attacks in a software-defined network. Experiments were conducted on the DARPA dataset, comparing the SVM classifier with other standard classification techniques. Although the classifier had higher accuracy, the SVM took more time, which is an obvious flaw. Amiri et al. [13], the authors used a least-squares SVM to decrease the training time on large datasets. Using three different feature extraction algorithms, they reduced the number of features from 41 to 19. The data were resampled to have around 7000 instances for each of the five classes of the KDD’99 dataset. The classification was reported at 99% for DoS, probe or scan, R2L and normal classes and 93% for U2R. Hu, et al. [14] utilized a robust SVM, which is a variation of SVM where the discriminating hyperplane is averaged to be smoother and the regularization parameter is automatically determined. Preprocessing training and testing of data was done on the Basic Security Module from the DARPA 1998 dataset. It showed 75% accuracy with no false positives and 100% accuracy with 3% false positives. Vuong et al. [15], the authors utilized decision trees to generate detection rules against denial-of-service and command injection attacks on robotic vehicles. Results showed that different attacks had different impacts on robotic behavior 3. PROPOSED SYSTEM The proposed system operates through a sequence of interconnected steps involving simulation, distributed processing, anomaly detection, and visualization. The proposed system integrates a network simulation layer with a MapReduce-based anomaly detection engine to provide a real-time monitoring dashboard. Users simulate file transfers on a network (Port 3333), generating traffic data that is independently analyzed by the Network Monitor (Port 4444). The core logic, simulated via MapReduce, classifies packets as normal or attack based on a size-based heuristic (e.g., MB), instantly updating internal counters as demonstrate in Figure 2. The results are immediately visualized on a JFreeChart Dashboard, offering trainees a direct, real-time understanding of how distributed processing and simple AI rules can detect and respond to network anomalies. 1. Network Simulation and Data Generation: The process begins with the Main and Network classes providing a graphical user interface where a user configures a network with simulated users. The user then initiates a file transfer (upload or download) via the Network class, selecting a file size and a simulated user ID. This action triggers two key concurrent processes: the file transfer itself handled by the Server (Port 3333) and the generation of network traffic data representing the file size, which is sent to the monitoring component. 2. Network Monitoring and Data Collection: A dedicated component, the Network Monitor (Port 4444), runs as a separate server listening for traffic flow information generated by the simulation. Upon

PARAGRAPH B¶14-18

Kokila et al. [12], the authors used an SVM classifier to detect DDoS attacks in a software-defined network. Experiments were conducted on the DARPA dataset, comparing the SVM classifier with other standard classification techniques. Although the classifier had higher accuracy, the SVM took more time, which is an obvious flaw. Amiri et al. [13], the authors used a least-squares SVM to decrease the training time on large datasets. Using three different feature extraction algorithms, they reduced the number of features from 41 to 19. The data were resampled to have around 7000 instances for each of the five classes of the KDD’99 dataset. The classification was reported at 99% for DoS, probe or scan, R2L and normal classes and 93% for U2R. Hu, et al. [14] utilized a robust SVM, which is a variation of SVM where the discriminating hyperplane is averaged to be smoother and the regularization parameter is automatically determined. Preprocessing training and testing of data was done on the Basic Security Module from the DARPA 1998 dataset. It showed 75% accuracy with no false positives and 100% accuracy with 3% false positives. Vuong et al. [15], the authors utilized decision trees to generate detection rules against denial-of-service and command injection attacks on robotic vehicles. Results showed that different attacks had different impacts on robotic behavior 3. PROPOSED SYSTEM The proposed system operates through a sequence of interconnected steps involving simulation, distributed processing, anomaly detection, and visualization. The proposed system integrates a network simulation layer with a MapReduce-based anomaly detection engine to provide a real-time monitoring dashboard. Users simulate file transfers on a network (Port 3333), generating traffic data that is independently analyzed by the Network Monitor (Port 4444). The core logic, simulated via MapReduce, classifies packets as normal or attack based on a size-based heuristic (e.g., MB), instantly updating internal counters as demonstrate in Figure 2. The results are immediately visualized on a JFreeChart Dashboard, offering trainees a direct, real-time understanding of how distributed processing and simple AI rules can detect and respond to network anomalies. 1. Network Simulation and Data Generation: The process begins with the Main and Network classes providing a graphical user interface where a user configures a network with simulated users. The user then initiates a file transfer (upload or download) via the Network class, selecting a file size and a simulated user ID. This action triggers two key concurrent processes: the file transfer itself handled by the Server (Port 3333) and the generation of network traffic data representing the file size, which is sent to the monitoring component. 2. Network Monitoring and Data Collection: A dedicated component, the Network Monitor (Port 4444), runs as a separate server listening for traffic flow information generated by the simulation. Upon

PARAGRAPH B¶14-18

Kokila et al. [12], the authors used an SVM classifier to detect DDoS attacks in a software-defined network. Experiments were conducted on the DARPA dataset, comparing the SVM classifier with other standard classification techniques. Although the classifier had higher accuracy, the SVM took more time, which is an obvious flaw. Amiri et al. [13], the authors used a least-squares SVM to decrease the training time on large datasets. Using three different feature extraction algorithms, they reduced the number of features from 41 to 19. The data were resampled to have around 7000 instances for each of the five classes of the KDD’99 dataset. The classification was reported at 99% for DoS, probe or scan, R2L and normal classes and 93% for U2R. Hu, et al. [14] utilized a robust SVM, which is a variation of SVM where the discriminating hyperplane is averaged to be smoother and the regularization parameter is automatically determined. Preprocessing training and testing of data was done on the Basic Security Module from the DARPA 1998 dataset. It showed 75% accuracy with no false positives and 100% accuracy with 3% false positives. Vuong et al. [15], the authors utilized decision trees to generate detection rules against denial-of-service and command injection attacks on robotic vehicles. Results showed that different attacks had different impacts on robotic behavior 3. PROPOSED SYSTEM The proposed system operates through a sequence of interconnected steps involving simulation, distributed processing, anomaly detection, and visualization. The proposed system integrates a network simulation layer with a MapReduce-based anomaly detection engine to provide a real-time monitoring dashboard. Users simulate file transfers on a network (Port 3333), generating traffic data that is independently analyzed by the Network Monitor (Port 4444). The core logic, simulated via MapReduce, classifies packets as normal or attack based on a size-based heuristic (e.g., MB), instantly updating internal counters as demonstrate in Figure 2. The results are immediately visualized on a JFreeChart Dashboard, offering trainees a direct, real-time understanding of how distributed processing and simple AI rules can detect and respond to network anomalies. 1. Network Simulation and Data Generation: The process begins with the Main and Network classes providing a graphical user interface where a user configures a network with simulated users. The user then initiates a file transfer (upload or download) via the Network class, selecting a file size and a simulated user ID. This action triggers two key concurrent processes: the file transfer itself handled by the Server (Port 3333) and the generation of network traffic data representing the file size, which is sent to the monitoring component. 2. Network Monitoring and Data Collection: A dedicated component, the Network Monitor (Port 4444), runs as a separate server listening for traffic flow information generated by the simulation. Upon

PARAGRAPH B¶15-19

Hu, et al. [14] utilized a robust SVM, which is a variation of SVM where the discriminating hyperplane is averaged to be smoother and the regularization parameter is automatically determined. Preprocessing training and testing of data was done on the Basic Security Module from the DARPA 1998 dataset. It showed 75% accuracy with no false positives and 100% accuracy with 3% false positives. Vuong et al. [15], the authors utilized decision trees to generate detection rules against denial-of-service and command injection attacks on robotic vehicles. Results showed that different attacks had different impacts on robotic behavior 3. PROPOSED SYSTEM The proposed system operates through a sequence of interconnected steps involving simulation, distributed processing, anomaly detection, and visualization. The proposed system integrates a network simulation layer with a MapReduce-based anomaly detection engine to provide a real-time monitoring dashboard. Users simulate file transfers on a network (Port 3333), generating traffic data that is independently analyzed by the Network Monitor (Port 4444). The core logic, simulated via MapReduce, classifies packets as normal or attack based on a size-based heuristic (e.g., MB), instantly updating internal counters as demonstrate in Figure 2. The results are immediately visualized on a JFreeChart Dashboard, offering trainees a direct, real-time understanding of how distributed processing and simple AI rules can detect and respond to network anomalies. 1. Network Simulation and Data Generation: The process begins with the Main and Network classes providing a graphical user interface where a user configures a network with simulated users. The user then initiates a file transfer (upload or download) via the Network class, selecting a file size and a simulated user ID. This action triggers two key concurrent processes: the file transfer itself handled by the Server (Port 3333) and the generation of network traffic data representing the file size, which is sent to the monitoring component. 2. Network Monitoring and Data Collection: A dedicated component, the Network Monitor (Port 4444), runs as a separate server listening for traffic flow information generated by the simulation. Upon

PARAGRAPH B¶16-23

3. PROPOSED SYSTEM The proposed system operates through a sequence of interconnected steps involving simulation, distributed processing, anomaly detection, and visualization. The proposed system integrates a network simulation layer with a MapReduce-based anomaly detection engine to provide a real-time monitoring dashboard. Users simulate file transfers on a network (Port 3333), generating traffic data that is independently analyzed by the Network Monitor (Port 4444). The core logic, simulated via MapReduce, classifies packets as normal or attack based on a size-based heuristic (e.g., MB), instantly updating internal counters as demonstrate in Figure 2. The results are immediately visualized on a JFreeChart Dashboard, offering trainees a direct, real-time understanding of how distributed processing and simple AI rules can detect and respond to network anomalies. 1. Network Simulation and Data Generation: The process begins with the Main and Network classes providing a graphical user interface where a user configures a network with simulated users. The user then initiates a file transfer (upload or download) via the Network class, selecting a file size and a simulated user ID. This action triggers two key concurrent processes: the file transfer itself handled by the Server (Port 3333) and the generation of network traffic data representing the file size, which is sent to the monitoring component. 2. Network Monitoring and Data Collection: A dedicated component, the Network Monitor (Port 4444), runs as a separate server listening for traffic flow information generated by the simulation. Upon receiving this data (the simulated file size), the monitor component initiates the core analysis by calling the simulated MapReduce job. This separates the function of secure data storage/transfer from the function of security monitoring and analysis, mimicking a decoupled enterprise environment. Figure 2: Proposed system architecture. 3. Anomaly Detection via MapReduce Simulation: The received traffic data (file size) is passed to the Hadoop runner class, which simulates the execution of a distributed job. The core security logic resides in the MapReduce class, specifically its map function. Here, the raw size data is converted to megabytes, and the AI-driven logic (currently a simple rule: size > 50 MB) is applied to determine the packet status. If the size exceeds the threshold, the traffic is flagged as "abnormal" (attack), otherwise, it is flagged as "normal." This step updates static counters (Network Monitor.normal and Network Monitor.attack) in real-time. 4. Real-Time Dashboard Visualization: As the MapReduce process classifies packets and updates the counters, the monitoring results are immediately ready for display. The user can click a button on the NetworkMonitor GUI to launch the Chart class. This class uses the JFreeChart library to dynamically pull the updated normal and attack packet counts from the NetworkMonitor and render them into a Comparison Bar Graph. This dashboard provides an instantaneous visual feedback loop, allowing the trainee to observe the direct impact of their simulated actions (e.g., uploading a large "attack" file) on the network's security status. 5. Secure File Handling and Response: Separately, the Server and Process Thread handle the actual file upload/download requests. Importantly, the system can demonstrate a security response: if a simulated attack is detected (or explicitly commanded by the user), the Process Thread logs a message indicating that the file is being ignored due to "Malicious Content detected," completing the training cycle of detection and response within the simulated environment.

PARAGRAPH B¶19-23

receiving this data (the simulated file size), the monitor component initiates the core analysis by calling the simulated MapReduce job. This separates the function of secure data storage/transfer from the function of security monitoring and analysis, mimicking a decoupled enterprise environment. Figure 2: Proposed system architecture. 3. Anomaly Detection via MapReduce Simulation: The received traffic data (file size) is passed to the Hadoop runner class, which simulates the execution of a distributed job. The core security logic resides in the MapReduce class, specifically its map function. Here, the raw size data is converted to megabytes, and the AI-driven logic (currently a simple rule: size > 50 MB) is applied to determine the packet status. If the size exceeds the threshold, the traffic is flagged as "abnormal" (attack), otherwise, it is flagged as "normal." This step updates static counters (Network Monitor.normal and Network Monitor.attack) in real-time. 4. Real-Time Dashboard Visualization: As the MapReduce process classifies packets and updates the counters, the monitoring results are immediately ready for display. The user can click a button on the NetworkMonitor GUI to launch the Chart class. This class uses the JFreeChart library to dynamically pull the updated normal and attack packet counts from the NetworkMonitor and render them into a Comparison Bar Graph. This dashboard provides an instantaneous visual feedback loop, allowing the trainee to observe the direct impact of their simulated actions (e.g., uploading a large "attack" file) on the network's security status. 5. Secure File Handling and Response: Separately, the Server and Process Thread handle the actual file upload/download requests. Importantly, the system can demonstrate a security response: if a simulated attack is detected (or explicitly commanded by the user), the Process Thread logs a message indicating that the file is being ignored due to "Malicious Content detected," completing the training cycle of detection and response within the simulated environment.

PARAGRAPH B¶20-24

receiving this data (the simulated file size), the monitor component initiates the core analysis by calling the simulated MapReduce job. This separates the function of secure data storage/transfer from the function of security monitoring and analysis, mimicking a decoupled enterprise environment. Figure 2: Proposed system architecture. 3. Anomaly Detection via MapReduce Simulation: The received traffic data (file size) is passed to the Hadoop runner class, which simulates the execution of a distributed job. The core security logic resides in the MapReduce class, specifically its map function. Here, the raw size data is converted to megabytes, and the AI-driven logic (currently a simple rule: size > 50 MB) is applied to determine the packet status. If the size exceeds the threshold, the traffic is flagged as "abnormal" (attack), otherwise, it is flagged as "normal." This step updates static counters (Network Monitor.normal and Network Monitor.attack) in real-time. 4. Real-Time Dashboard Visualization: As the MapReduce process classifies packets and updates the counters, the monitoring results are immediately ready for display. The user can click a button on the NetworkMonitor GUI to launch the Chart class. This class uses the JFreeChart library to dynamically pull the updated normal and attack packet counts from the NetworkMonitor and render them into a Comparison Bar Graph. This dashboard provides an instantaneous visual feedback loop, allowing the trainee to observe the direct impact of their simulated actions (e.g., uploading a large "attack" file) on the network's security status. 5. Secure File Handling and Response: Separately, the Server and Process Thread handle the actual file upload/download requests. Importantly, the system can demonstrate a security response: if a simulated attack is detected (or explicitly commanded by the user), the Process Thread logs a message indicating that the file is being ignored due to "Malicious Content detected," completing the training cycle of detection and response within the simulated environment. 4. RESULTS ANALYSIS The results section presents the operational performance of the developed cybersecurity simulation system designed for monitoring network activity and secure file transmission. The system integrates user nodes, a network monitor, and a server module to simulate real-time communication within a controlled environment. Various stages such as file upload, validation, storage, request handling, and download processes are demonstrated through graphical and console-based outputs. The obtained results verify the effectiveness of the system in monitoring network behavior and managing secure data transfer operations.

PARAGRAPH B¶21-26

Figure 2: Proposed system architecture. 3. Anomaly Detection via MapReduce Simulation: The received traffic data (file size) is passed to the Hadoop runner class, which simulates the execution of a distributed job. The core security logic resides in the MapReduce class, specifically its map function. Here, the raw size data is converted to megabytes, and the AI-driven logic (currently a simple rule: size > 50 MB) is applied to determine the packet status. If the size exceeds the threshold, the traffic is flagged as "abnormal" (attack), otherwise, it is flagged as "normal." This step updates static counters (Network Monitor.normal and Network Monitor.attack) in real-time. 4. Real-Time Dashboard Visualization: As the MapReduce process classifies packets and updates the counters, the monitoring results are immediately ready for display. The user can click a button on the NetworkMonitor GUI to launch the Chart class. This class uses the JFreeChart library to dynamically pull the updated normal and attack packet counts from the NetworkMonitor and render them into a Comparison Bar Graph. This dashboard provides an instantaneous visual feedback loop, allowing the trainee to observe the direct impact of their simulated actions (e.g., uploading a large "attack" file) on the network's security status. 5. Secure File Handling and Response: Separately, the Server and Process Thread handle the actual file upload/download requests. Importantly, the system can demonstrate a security response: if a simulated attack is detected (or explicitly commanded by the user), the Process Thread logs a message indicating that the file is being ignored due to "Malicious Content detected," completing the training cycle of detection and response within the simulated environment. 4. RESULTS ANALYSIS The results section presents the operational performance of the developed cybersecurity simulation system designed for monitoring network activity and secure file transmission. The system integrates user nodes, a network monitor, and a server module to simulate real-time communication within a controlled environment. Various stages such as file upload, validation, storage, request handling, and download processes are demonstrated through graphical and console-based outputs. The obtained results verify the effectiveness of the system in monitoring network behavior and managing secure data transfer operations. Figure 3: Confirmation of successful file download in the network. The figure 3 shows the Cyber Security simulation environment, demonstrating the successful completion of a file download. Following the request seen in the previous image, a central "Message" dialog box confirms "112.jpg downloaded to E directory". This message is reinforced by the status bar at the bottom, which reads "User ID U12 Filename 112.jpg: 112.jpg downloaded to E directory". The visual layout, including the Server, Network Monitor, and various color-coded User nodes, remains the same, but the key element here is the system's notification verifying the completion of the file transfer operation.

PARAGRAPH B¶25-29

Figure 3: Confirmation of successful file download in the network. The figure 3 shows the Cyber Security simulation environment, demonstrating the successful completion of a file download. Following the request seen in the previous image, a central "Message" dialog box confirms "112.jpg downloaded to E directory". This message is reinforced by the status bar at the bottom, which reads "User ID U12 Filename 112.jpg: 112.jpg downloaded to E directory". The visual layout, including the Server, Network Monitor, and various color-coded User nodes, remains the same, but the key element here is the system's notification verifying the completion of the file transfer operation. Figure 4: Comparison graph of normal and attack packets detected by the mapreduce server. Figure 4 presents a comparative bar chart illustrating the distribution of Total Normal Packets and Total Attack Packets within the monitored network traffic. The visualization clearly shows a dominant concentration of normal packets, represented by the tall blue bar, while the attack packet category is either extremely small or nearly absent in comparison. This indicates that the captured dataset is highly imbalanced, with legitimate network communication forming the overwhelming majority of traffic and only negligible malicious activity detected during monitoring. Such a distribution suggests that the network environment was largely stable and secure during data collection, but it also highlights a potential challenge for machine learning models, as severe class imbalance may affect training performance and require balancing techniques such as resampling or weighting to ensure accurate intrusion detection. Figure 5: Console log of cyber-crime & security server activity and file transactions Figure 5 presents the console output specifically functioning as the "Cyber Security Storage Server." This window serves as a transaction log, documenting the server's operational status and recent activity. The log confirms that the "Cyber Security Server Started" and records multiple successful "Connected Computers :127.0.0.1" events. Crucially, it tracks file management operations, repeatedly noting that "charan.res saved at server" and confirming the successful delivery of a file with the entry "Charan.res File sent to user 1," which aligns with the observed download actions from the network simulation. In summary, the console validates the server's connectivity, data storage, and the successful delivery of the requested file to user U1.

PARAGRAPH B¶25-29

Figure 3: Confirmation of successful file download in the network. The figure 3 shows the Cyber Security simulation environment, demonstrating the successful completion of a file download. Following the request seen in the previous image, a central "Message" dialog box confirms "112.jpg downloaded to E directory". This message is reinforced by the status bar at the bottom, which reads "User ID U12 Filename 112.jpg: 112.jpg downloaded to E directory". The visual layout, including the Server, Network Monitor, and various color-coded User nodes, remains the same, but the key element here is the system's notification verifying the completion of the file transfer operation. Figure 4: Comparison graph of normal and attack packets detected by the mapreduce server. Figure 4 presents a comparative bar chart illustrating the distribution of Total Normal Packets and Total Attack Packets within the monitored network traffic. The visualization clearly shows a dominant concentration of normal packets, represented by the tall blue bar, while the attack packet category is either extremely small or nearly absent in comparison. This indicates that the captured dataset is highly imbalanced, with legitimate network communication forming the overwhelming majority of traffic and only negligible malicious activity detected during monitoring. Such a distribution suggests that the network environment was largely stable and secure during data collection, but it also highlights a potential challenge for machine learning models, as severe class imbalance may affect training performance and require balancing techniques such as resampling or weighting to ensure accurate intrusion detection. Figure 5: Console log of cyber-crime & security server activity and file transactions Figure 5 presents the console output specifically functioning as the "Cyber Security Storage Server." This window serves as a transaction log, documenting the server's operational status and recent activity. The log confirms that the "Cyber Security Server Started" and records multiple successful "Connected Computers :127.0.0.1" events. Crucially, it tracks file management operations, repeatedly noting that "charan.res saved at server" and confirming the successful delivery of a file with the entry "Charan.res File sent to user 1," which aligns with the observed download actions from the network simulation. In summary, the console validates the server's connectivity, data storage, and the successful delivery of the requested file to user U1.

PARAGRAPH B¶25-30

Figure 3: Confirmation of successful file download in the network. The figure 3 shows the Cyber Security simulation environment, demonstrating the successful completion of a file download. Following the request seen in the previous image, a central "Message" dialog box confirms "112.jpg downloaded to E directory". This message is reinforced by the status bar at the bottom, which reads "User ID U12 Filename 112.jpg: 112.jpg downloaded to E directory". The visual layout, including the Server, Network Monitor, and various color-coded User nodes, remains the same, but the key element here is the system's notification verifying the completion of the file transfer operation. Figure 4: Comparison graph of normal and attack packets detected by the mapreduce server. Figure 4 presents a comparative bar chart illustrating the distribution of Total Normal Packets and Total Attack Packets within the monitored network traffic. The visualization clearly shows a dominant concentration of normal packets, represented by the tall blue bar, while the attack packet category is either extremely small or nearly absent in comparison. This indicates that the captured dataset is highly imbalanced, with legitimate network communication forming the overwhelming majority of traffic and only negligible malicious activity detected during monitoring. Such a distribution suggests that the network environment was largely stable and secure during data collection, but it also highlights a potential challenge for machine learning models, as severe class imbalance may affect training performance and require balancing techniques such as resampling or weighting to ensure accurate intrusion detection. Figure 5: Console log of cyber-crime & security server activity and file transactions Figure 5 presents the console output specifically functioning as the "Cyber Security Storage Server." This window serves as a transaction log, documenting the server's operational status and recent activity. The log confirms that the "Cyber Security Server Started" and records multiple successful "Connected Computers :127.0.0.1" events. Crucially, it tracks file management operations, repeatedly noting that "charan.res saved at server" and confirming the successful delivery of a file with the entry "Charan.res File sent to user 1," which aligns with the observed download actions from the network simulation. In summary, the console validates the server's connectivity, data storage, and the successful delivery of the requested file to user U1. 5. CONCLUSION The proposed AI-driven Cybersecurity Simulator seamlessly combines network monitoring, MapReduce-based traffic analysis, and intelligent anomaly detection within a unified framework. The system provides a realistic simulation environment in which multiple network users perform file upload and download operations, while packet-level traffic is continuously monitored to identify potential threats. The incorporation of real-time feedback, secure file handling mechanisms, and graphical visualization of network activity significantly enhances the understanding of cybersecurity operations and attack behaviors. The proposed system demonstrates strong capability in identifying abnormal traffic patterns, preventing the storage of malicious files, and maintaining overall system integrity. Furthermore, the integration of AI techniques with MapReduce-based big data processing highlights the practical applicability of scalable and intelligent solutions in modern network security. In conclusion, this research successfully achieves its objective of developing an interactive, automated, and intelligent platform for cybersecurity training, monitoring, and threat mitigation.

PARAGRAPH B¶27-30

Figure 4: Comparison graph of normal and attack packets detected by the mapreduce server. Figure 4 presents a comparative bar chart illustrating the distribution of Total Normal Packets and Total Attack Packets within the monitored network traffic. The visualization clearly shows a dominant concentration of normal packets, represented by the tall blue bar, while the attack packet category is either extremely small or nearly absent in comparison. This indicates that the captured dataset is highly imbalanced, with legitimate network communication forming the overwhelming majority of traffic and only negligible malicious activity detected during monitoring. Such a distribution suggests that the network environment was largely stable and secure during data collection, but it also highlights a potential challenge for machine learning models, as severe class imbalance may affect training performance and require balancing techniques such as resampling or weighting to ensure accurate intrusion detection. Figure 5: Console log of cyber-crime & security server activity and file transactions Figure 5 presents the console output specifically functioning as the "Cyber Security Storage Server." This window serves as a transaction log, documenting the server's operational status and recent activity. The log confirms that the "Cyber Security Server Started" and records multiple successful "Connected Computers :127.0.0.1" events. Crucially, it tracks file management operations, repeatedly noting that "charan.res saved at server" and confirming the successful delivery of a file with the entry "Charan.res File sent to user 1," which aligns with the observed download actions from the network simulation. In summary, the console validates the server's connectivity, data storage, and the successful delivery of the requested file to user U1. 5. CONCLUSION The proposed AI-driven Cybersecurity Simulator seamlessly combines network monitoring, MapReduce-based traffic analysis, and intelligent anomaly detection within a unified framework. The system provides a realistic simulation environment in which multiple network users perform file upload and download operations, while packet-level traffic is continuously monitored to identify potential threats. The incorporation of real-time feedback, secure file handling mechanisms, and graphical visualization of network activity significantly enhances the understanding of cybersecurity operations and attack behaviors. The proposed system demonstrates strong capability in identifying abnormal traffic patterns, preventing the storage of malicious files, and maintaining overall system integrity. Furthermore, the integration of AI techniques with MapReduce-based big data processing highlights the practical applicability of scalable and intelligent solutions in modern network security. In conclusion, this research successfully achieves its objective of developing an interactive, automated, and intelligent platform for cybersecurity training, monitoring, and threat mitigation.