The rapid expansion of email usage has been paralleled by a significant rise in spam, which not only clutters inboxes but also spreads malware and introduces serious security threats. While machine learning (ML) has proven to be a powerful approach for spam detection, single-classifier models often face issues such as poor generalization, overfitting, and elevated false positive rates. Key challenges in email spam detection include: (1) Improving accuracy while keeping false positives low to maintain usability; (2) Responding to threats in real-time; (3) Handling the ever-changing characteristics of email content; and (4) Automating model adaptation to these changes. To address these challenges, this study presents SHRED (Sifting Ham for Real-time Email Spam Detection), an ensemble-based ML model specifically built for real-time spam filtering. SHRED combines Naive Bayes, Decision Trees, Adaptive Boosting, Random Forests, and Artificial Neural Networks using a hybrid approach of voting and stacking to enhance detection performance. It employs preprocessing methods such as text normalization and TF-IDF-driven feature selection to produce resilient input representations that automatically adapt to evolving email patterns. When tested on a diverse dataset of 83,448 emails, SHRED achieved a detection rate of 98.4%, a false positive rate of 1.6%, and an overall accuracy of 98.45%, with an average processing time of just 0.0522 seconds per email. This includes all stages: preprocessing, feature extraction and selection, training, and detection, underscoring the system’s capability to accurately detect spam in real-time.

The increasing complexity and scale of cyber threats demand intelligent and adaptive defense mechanisms that extend beyond traditional approaches. Artificial Intelligence (AI) has emerged as a key enabler for enhancing cyber security through automated detection, analysis, and response. This paper presents a comprehensive survey of AI applications in cyber security across five major domains: malware detection, intrusion detection, phishing and spam detection, botnet detection, and cyber forensics. A systematic methodology based on data and methodological triangulation is employed to analyze 75 studies published between 2021 and 2025. The paper introduces a multi-layer taxonomy that maps cyber threats to application domains, analysis methods, AI approaches, and their associated capabilities and limitations. In addition, a cross-domain meta-analysis is conducted to identify recurring trends and assess the adoption of AI across different cyber security scenarios. The analysis reveals that deep learning and transformer-based models dominate data-intensive domains such as intrusion detection and malware analysis, whereas traditional machine learning techniques remain effective in structured and resource-constrained settings, particularly for phishing detection. Key challenges include dataset limitations, limited explainability, adversarial vulnerabilities, and computational constraints. Unlike existing surveys that focus on specific techniques or individual cyber security domains, this work provides a unified, application-oriented perspective on AI-driven cyber security. It further highlights emerging trends, open challenges, and future research directions toward more robust, scalable, and trustworthy cyber security systems.

Android malware continues to evolve in sophistication, creating a need for accurate, efficient, and interpretable detection mechanisms. This paper proposes a novel Android malware detection framework that integrates graph-based software engineering analysis, explainable artificial intelligence (XAI), and heterogeneous ensemble learning. The framework decompiles Android applications, constructs call graphs and control flow graphs, and extracts structural, functional, and behavioral software engineering metrics that are transformed into statistical feature representations. To improve feature quality and reduce dimensionality, LIME and SHAP are engineered into a threshold-based feature relevance mechanism, reducing the original 89 features to 65 and 61 features, respectively. A new heterogeneous ensemble classifier, RF–LNN–GRU, is then introduced to combine the complementary strengths of random forest, lightweight neural networks, and gated recurrent units through asymmetric probabilistic voting. Experiments conducted on 10,365 Android applications demonstrate that the proposed framework consistently outperforms conventional machine learning and ensemble baselines, achieving a detection rate of 98.98%, an F1-score of 96.2%, and an AUC of 98.1% while maintaining an inference latency below 0.4 ms per sample. These results demonstrate that the proposed combination of graph-derived software engineering metrics, XAI-guided feature engineering, and heterogeneous ensemble learning provides an effective and computationally efficient solution for Android malware detection.