University Academic Management Information Systems (ACMIS) handle sensitive data including student records, financial transactions, and academic integrity logs, making them prime targets for a wide spectrum of cyber threats. Traditional rule-based intrusion detection systems (IDS) often fail because many malicious activities are structurally indistinguishable from normal operations, according to a recent paper by Walusimbi and Ssentongo published on arXiv.
The paper presents an AI-based security agent that monitors five operational layers: authentication, authorisation, financial transactions, user behaviour, and system health. The agent combines supervised anomaly detection, behavioural analytics, and a natural language processing (NLP) chatbot for secure password recovery. It responds to threats through a four-tier risk escalation framework, ensuring appropriate action from low-risk alerts to automated critical-tier responses.
Performance Benchmarks Against Baselines
Experiments on a simulated ACMIS event log dataset of 147,922 sessions demonstrated the agent's effectiveness. The AI agent achieved a macro-average F1 score of 0.966 for threat detection, compared to 0.156 for a rule-based baseline and 0.836 for a sequence-only LSTM baseline. The end-to-end critical-tier automated response latency measured under 1 millisecond on a single-node prototype.
| Detection Method | Macro-Average F1 Score |
|---|---|
| AI Security Agent | 0.966 |
| Rule-based baseline | 0.156 |
| Sequence-only LSTM baseline | 0.836 |
Integrated Password Recovery Chatbot
The agent's NLP chatbot for password recovery achieved 97.1% identity verification accuracy and an 87.3% mass-reset attack detection rate, with zero false positives reported on legitimate high-volume recovery periods, according to the paper. This capability addresses a common attack vector where adversaries exploit password reset processes to gain unauthorised access.
Modular Architecture for Broader Application
The authors designed the AI agent with a modular architecture, allowing the core detection and response engine to be extended to other institutional systems beyond ACMIS. This modularity, combined with the multi-layer monitoring approach, suggests potential applicability to other high-value transactional environments, including supply chain management systems, trade finance platforms, and customs technology infrastructure where similar threat patterns exist.
Implications for Enterprise Security
For technology leaders in logistics and trade, the combination of supervised anomaly detection and behavioural analytics offers a blueprint for defending against insider data theft, payment fraud, and privilege escalation — threats that also plague supply chain and trade finance systems. The sub-millisecond response latency enables real-time blocking of attacks without disrupting legitimate operations, a critical requirement for high-throughput trade environments. While the prototype was tested on university data, the paper's methodology and modular design provide a foundation that could be adapted to protect any system where rule-based detection falls short.
