Conventional cybersecurity techniques, including firewalls and signature-based malware detection, lack the adaptability to respond effectively to novel and complex cyber threats in real time.

AI-driven cybersecurity methods, including Machine Learning (ML) and Deep Learning (DL), enhance threat detection in Cloud-IoT infrastructures by analyzing large datasets for patterns, allowing systems to identify known and unknown risks. Key approaches include anomaly detection, which monitors real-time data for unusual activity; supervised learning, which classifies threats based on known examples; and unsupervised learning, which identifies hidden patterns in unlabeled data, making it ideal for emerging threats. These methods create adaptive, proactive security measures, enabling smart cities to safeguard against complex and evolving cyber risks effectively.

Data was collected from public IoT network logs and processed for training using feature extraction techniques.

Algorithms were designed to detect anomalies and identify intrusion patterns. Each component in the system was evaluated based on its performance in identifying and responding to security incidents.

I. Reduction in downtime: The AI system significantly reduced downtime by quickly identifying and neutralizing threats. This proactive detection allowed city operators to maintain traffic management operations without interruptions.

II. Enhanced operational resilience: The adaptive nature of the AI algorithms enabled the system to remain resilient against known and emerging threats, adapting to changing attack vectors typical of dynamic IoT environments.

III. Scalability: The system successfully handled large-scale IoT data streams, proving its scalability for future smart city deployments with larger sensor networks.

The case study demonstrates how AI-enhanced cybersecurity frameworks can maintain infrastructure integrity in high-stakes, data-intensive environments like smart city traffic systems. This approach ensures the safety of critical systems and supports uninterrupted city operations by preemptively addressing cyber threats.

With the increased integration of IoT devices in smart cities, vast amounts of data are continuously generated, transmitted, and stored in the cloud. Ensuring the privacy and security of this data becomes a primary concern, particularly as cybercriminals target data flows and cloud storage to exploit vulnerabilities. AI algorithms require access to large datasets for training and refining, but this reliance on data raises questions about privacy and compliance with regulations like GDPR and CCPA.

Solution: Techniques such as differential privacy and federated learning can enable AI to learn from decentralized data without centralizing sensitive information, thereby reducing the risk of privacy breaches.

AI models used in cybersecurity are susceptible to adversarial attacks, where attackers intentionally manipulate input data to deceive the AI system. For instance, an attacker could introduce subtle changes in the data that go undetected by th.e model but influence its decision-making process, potentially leading to incorrect threat detection or allowing malicious actions to bypass security.

Solution: Developing robust AI models that can withstand adversarial examples is an ongoing area of research. Techniques like adversarial training and robust optimization can enhance models' resilience against such attacks.

Implementing AI algorithms in real-time cybersecurity applications for IoT systems often requires significant computational power and storage resources, which may be limited in cloud-IoT infrastructures. Additionally, as the number of connected devices in a smart city increases, the cybersecurity system must be scalable to handle the larger volume of data and traffic without sacrificing performance.

Solution: Efficient, scalable AI models running on edge devices with limited processing power are essential for practical deployment. Lightweight neural networks and edge computing techniques enable the distribution of processing loads, thereby reducing reliance on central cloud resources and improving scalability.

[10] Machine (SVM) quantitative features accuracy of 0.85 with approach to differentiate were involved. sensitivity and specificity the Non Tuberculous of 0.88 and 0.80 Mycobacteria (NTM) and respectively. PTB.

Jin et al. Auto Encoder No dataset was 81.26% accuracy was The Auto Encoder [11] Convolution mentioned. achieved with recall and Convolution Neural Neural Network f1 score of 81.72% and Network is used by 81.49% respectively. researchers for the classification of PTB based on CT images.

Li et al. Convolution 501 CT image Model provides recall of Researchers establish a DL [12] Neural Network dataset of active 98.7% and precision of system that quantitative PTB and 501 for 93.7%. Computed Tomography negative samples. (CT) reports for the diagnosis of PTB.

Lakhani Two deep 1007 posteroanterior Model provides AUC of Researchers evaluate the and convolution chest radiographs 0.99 with sensitivity of efficacy of DCNNs for Sundaram neural networks; 97.3% and specificity detection of TB on chest [13] AlexNet and 100%. radiographs.

GoogleNetre were used.

[14] was used. and 1990 classification AUC of model that can differentiate Sarcoidosis patients 81% with between PTB and data was used. sarcoidosis.

Ho et al. Deep convolution Public dataset Highest AUC achieved Researchers examine the [15] neural network; ChestXray14 was for DenseNet 121 i.e. efficiency of DCNNs for ResNet152, used as training and 0.95. the detection of TB on Inception-ResNet two datasets chest radiographs.

and DenseNet121 Montgomery and was used. Shenzhen were used as testing datasets.

Support Vector Machines (SVMs) and K-Nearest Neighbors (KNN) are popular for network intrusion detection because they accurately classify data into predefined categories. SVMs identify optimal class boundaries, distinguishing between legitimate and suspicious network activity. At the same time, KNN evaluates new network events based on the 'closeness' of historical events, making it adaptable to evolving IoT data patterns.

As a specialized algorithm for large datasets, Isolation Forests are used for anomaly detection in large-scale IoT environments. Unlike traditional clustering methods, Isolation Forests isolate anomalies based on their unique characteristics, making them efficient at processing high volumes of real-time IoT data and flagging suspicious behavior with minimal computational resources.

Convolutional Neural Networks (CNNs) are commonly employed for malware detection in network traffic. By analyzing packet-level data, CNNs can identify intricate patterns indicative of malicious code, particularly when malware attempts to disguise itself within normal data flows.

Recurrent Neural Networks (RNNs) and autoencoders are powerful for sequential and unsupervised anomaly detection. RNNs process time-dependent data sequences, making them well-suited for IoT environments with continuous data streams. Autoencoders, particularly useful in unsupervised settings, detect unusual data points by encoding input data into a compressed representation and then reconstructing it, with deviations from the norm highlighting potential security issues.

Q-learning and Deep Q-Networks (DQN) algorithms enable systems to adapt their defense strategies based on evolving threat landscapes. Through trial-and-error and reward-based learning, these algorithms determine optimal actions (e.g., blocking, rerouting, or isolating data) in response to various security threats, offering a highly responsive and flexible approach that can adjust as new threats emerge.

NLP tools like Named Entity Recognition (NER) and text classification are used for threat intelligence analysis by extracting actionable insights from security reports, alerts, and open-source threat intelligence feeds. NER identifies and categorizes relevant entities, such as IP addresses or malware types, while text classification helps categorize threats, enhancing situational awareness and accelerating response times across smart city infrastructures.