1. A computer-implemented method for predicting agricultural crop yield within a unified multi-domain AI framework, the method including: receiving a set of agronomic and environmental parameters such as crop type, country, average annual rainfall in millimeters, average temperature in degrees Celsius, growing season, climate zone, soil quality index, field area in hectares, irrigation usage, fertilizer application rate in kilograms per hectare, soil pH level, and humidity percentage; encoding categorical input fields using pre-fitted Label Encoders stored as serialized artifacts; passing the encoded feature vector to a trained ensemble machine learning model selected from a Random Forest regressor or an XGBoost regressor; and returning a predicted yield value in hectograms per hectare along with a computed confidence interval and ranked feature importance scores.

2. The method of claim 1, where the ensemble machine learning model is either a Random Forest regressor with 100 decision trees and a maximum depth of 15 or an XGBoost regressor trained over 100 boosting rounds with a learning rate of 0.1. The user can select which model to use at query time through a unified API request parameter.

3. The method of claim 1 also includes calculating a total field yield by multiplying the predicted yield per hectare by the user-supplied field area. It also calculates a confidence interval where the lower bound equals 85% and the upper bound equals 115% of the predicted value.

4. The method of claim 1 also includes retrieving and returning pre-computed feature importance scores for each input variable ranked by percentage contribution. The main contributing features include average rainfall at about 28.5%, average temperature at about 22.1%, crop type at about 18.3%, soil quality index at about 12.4%, and pesticide usage at about 8.7%.

5. A computer-implemented method for network anomaly detection within a unified multi-domain AI framework, the method consisting of: (a) receiving network traffic records that include at least connection duration, protocol type, service, flag, source bytes, destination bytes, and host-level statistical features; (b) preprocessing the records by filling in missing values, encoding categorical attributes, and scaling numerical attributes; and (c) generating a feature vector representing behavioural Deep Packet Inspection characteristics for each record.

6. The method of claim 5 also includes training an Isolation Forest model on the feature vectors to compute an anomaly score and a binary indication of whether each record is normal or anomalous.

7. The method of claim 5 or 6 also includes training a clustering model, such as K-Means, on the feature vectors to assign each record to a cluster. It computes a distance between the record and the corresponding cluster centroid as an anomaly indicator.

8. A unified AI-driven multi-domain predictive system includes a domain-routing API gateway built with Flask. It receives JSON payloads and directs each request to either an Agricultural Yield Estimator module or a Network Traffic Anomaly Analyzer module based on a domain header field. It also includes a shared preprocessing pipeline that encodes categorical features, fills in missing values, and scales numerical inputs for both domain modules. Additionally, there is a standardized JSON response schema that provides domain type, prediction or anomaly result, confidence interval or anomaly score, model used, feature importance or anomaly visualization data, and a contextual insight message.

Description:Title:
UNIFIED AI-DRIVEN PREDICTIVE FRAMEWORK FOR MULTI-DOMAIN BEHAVIORAL ANOMALY DETECTION AND AGRICULTURAL YIELD FORECASTING

Field of the Invention
[0001] The present invention deals with computer science and artificial intelligence, focusing on two important applied areas: agricultural science and food technology, as well as cybersecurity and network security monitoring. The invention introduces a Unified AI-Driven Predictive Framework (UAIPF) based on a shared modular machine learning structure. This framework can be used across different data domains to tackle both predictive forecasting and behavioural anomaly detection.
[0002] In agriculture, the invention offers farmers, planners, and food security agencies a data-driven system to estimate crop yields using environmental and agronomic factors. In network security, it provides security engineers, SOC teams, and network administrators with an intelligent behavioural Deep Packet Inspection (DPI) framework that uses machine learning and anomaly detection methods to spot malicious or abnormal network traffic in real time.
[0003] The main idea that connects these two areas is that they treat their inputs—agronomic field parameters and network packet-level records—as high-dimensional behavioural feature vectors. These vectors are processed through a common preprocessing pipeline, sent to specific ensemble models, and returned as clear, scored outputs through a unified REST API.

Background
[0004] This section offers context to understand the motivation and scope of this invention. The materials referenced here do not imply that this information is prior art, nor do they suggest that the referenced work is related to or anticipated by the claims of this invention.

Agricultural Domain Background
[0005] Worldwide, agricultural productivity varies widely even for the same crop grown in similar conditions. Many small and mid-size farmers still rely on general advice from extension services or past experiences, which do not effectively account for annual weather changes, soil condition shifts, or fluctuations in input costs. A review of available data from the Food and Agriculture Organization (FAO) and the World Bank showed that high-quality structured data on crop yields, rainfall, temperature, and agronomic inputs already exists. However, what was lacking is a predictive layer that could learn the complex, nonlinear relationships between these factors and actual yield outcomes. Ensemble machine learning methods are well-suited to capture this complexity.

Network Security Domain Background
[0006] Modern computer networks face increasing risk from sophisticated cyber-attacks, such as denial-of-service, probing, malware spreading, and advanced persistent threats. Traditional signature-based DPI and rule-driven firewalls struggle against zero-day attacks and unfamiliar attack patterns. Standard anomaly-based intrusion detection systems often rely on rough traffic statistics, leading to high false positive rates, poor adaptability, and limited clarity on anomaly decisions. There is still a need for a system that extracts meaningful, DPI-inspired behavioural features from traffic, works in unsupervised or semi-supervised mode, and combines various anomaly detection models into a unified hybrid score.

Common Architectural Motivation
[0007] Both the agricultural and network security fields face a key challenge: varying behavioural feature vectors with complicated, nonlinear links between inputs and outcomes. This situation needs strong ensemble machine learning methods and clear explanations. Both systems work through a Flask-based REST API using the same technology stack: Python, Scikit-learn, Pandas, and NumPy. This makes a joined framework the most efficient choice in terms of computing and structure.

Objects of the Invention
[0008] The following goals guided the creation of the unified system:
• To build a modular, flexible AI inference engine with a standard preprocessing pipeline and a Model Selector that can switch between predictive yield forecasting (Agricultural Module) and behavioural anomaly detection (Network Security Module).
• To introduce, train, and compare ensemble machine learning models: Random Forest and XGBoost for regression (agricultural field), and Isolation Forest and K-Means for unsupervised anomaly detection (network field) within a single framework.
• To make sure all predictions and anomaly scores are clear and understandable, providing ranked feature importance scores in the agricultural module and hybrid anomaly score visualizations in the network module.
• To create a behavioural Deep Packet Inspection framework that turns raw network traffic into enhanced features showing packet size distributions, connection duration, protocol type, directionality, and host-level interaction statistics.
• To launch a hybrid anomaly scoring system blending results from Isolation Forest and K-Means clustering distances into a single dynamic anomaly score with adjustable or flexible thresholds.
• To make the entire unified framework available through one REST API endpoint that directs JSON payloads to the proper domain module based on request headers, allowing integration across agricultural advisory platforms, SIEM systems, and mobile applications.

Summary
[0009] This invention presents a Unified AI-Driven Predictive Framework (UAIPF), a single software design that handles structured JSON payloads. Depending on the domain header, it directs the data to either the Agricultural Yield Estimator or the Network Traffic Anomaly Analyzer.

Drawings

Figure 1: Flow Diagram of the Proposed System
Brief Description of the Drawing
[00010] The Figure 1 represents the flow diagram of the proposed system. Its different modules are explained below:

Agricultural Yield Estimator Module
[0011] A farmer or agricultural planner fills out an input form that includes: crop type, country, expected average rainfall (mm), average temperature (°C), growing season, climate zone, soil quality index, total field area (hectares), irrigation usage, fertilizer applied (kg/ha), soil pH level, and humidity percentage. Before making predictions, categorical fields are converted using pre-trained Label Encoders. The system loads the selected ensemble model—Random Forest or XGBoost—and provides a predicted yield in hectograms per hectare (Hg/Ha) along with a confidence interval (85%–115% of predicted value), total field yield, and ranked feature importance scores.

Network Traffic Anomaly Analyzer Module
[0012] The system processes network traffic records from benchmark datasets (NSL-KDD, CICIDS) or live packet streams. These streams include: connection duration, protocol type, service, flag, source bytes, destination bytes, and host-level statistical features. After preprocessing (filling in missing values, categorical encoding, numerical scaling), an Isolation Forest model generates an anomaly score and a binary normal/anomalous classification. At the same time, a K-Means clustering model calculates cluster distances to indicate anomalies. A hybrid anomaly score is created as a weighted combination of the normalized Isolation Forest score and the normalized cluster centroid distance. This score is then compared to a configurable or dynamic threshold to classify each record as NORMAL or ANOMALY.

Unified API Gateway
[0013] Both modules are accessible through a single Flask-based REST API. The JSON request header field 'domain' directs the payload to either 'agricultural' or 'network' processing pipelines. A simple web dashboard shows counts of normal versus anomalous records (network module), yield estimates, feature importance rankings (agricultural module), and graphical views of anomaly trends, all within one operational interface.

Detailed Description
[0014] The unified framework runs on Windows 10 and Linux operating systems, using Python 3.x as the main programming language. The core technology stack shared by the both modules is as follows:
 Flask: builds the unified REST API that handles requests and serves both domain modules over HTTP
 Scikit-learn: model training, cross-validation, Label Encoder pipeline, Isolation Forest, and K-Means clustering
 XGBoost: gradient boosting model for agricultural yield regression
 Pandas and NumPy: data loading, cleaning, feature engineering, and numerical processing
 Joblib: saves trained model objects and encoders to .pkl files for consistency during inference
 HTML, CSS, JavaScript: unified web dashboard interface

Agricultural Module - Model Architecture
[0015] Two regression models are key to the agricultural module. The first is a Random Forest regressor with 100 decision trees and a maximum tree depth of 15. Each tree uses a randomly sampled subset of training data, and the final prediction is the average of all 100 outputs. The second model is an XGBoost regressor trained over 100 boosting rounds with a learning rate of 0.1. Each successive tree corrects the errors of the previous one. Both models were trained on a cleaned dataset of over 5,000 records from FAO and World Bank sources, covering various countries, multiple crop types, and several decades of yield observations.
[0016] Feature importance analysis consistently identifies average rainfall (28.5%), average temperature (22.1%), crop type (18.3%), soil quality index (12.4%), and pesticide usage (8.7%) as the main contributors to yield prediction. These rankings are included with every prediction response.

Network Security Module - Model Architecture
[0017] The network module starts with a data acquisition layer that imports traffic records from NSL-KDD, CICIDS, or live network interfaces. Features include connection duration, protocol type (TCP, UDP, ICMP), service (HTTP, FTP), TCP flags, source and destination bytes, login indicators, and statistical connection-level features. After preprocessing, an Isolation Forest model is trained as the main anomaly detector. At the same time, a K-Means clustering model divides network behaviour into typical and atypical groups, using centroid distances as an anomaly indicator.
[0018] The hybrid anomaly score is calculated as: Score_hybrid = w1 × Score_IsoForest_normalized + w2 × Distance_KMeans_normalized. Here, w1 and w2 are configurable weights. This combined score is compared to a static threshold based on validation results or a dynamic threshold calculated from recent score distributions to adjust to changing traffic patterns.

Unified API Routing Logic
[0019] The Flask API has a single /predict endpoint. Incoming JSON payloads include a 'domain' header field set to either 'agricultural' or 'network'. The API Gateway checks this header and calls the appropriate preprocessing pipeline, model inference engine, and response formatter. Both modules return structured JSON responses, which include the domain type, prediction or anomaly result, confidence interval or anomaly score, model used, feature importance or anomaly visualization data, and a contextual insight message.

Intended Users
[0020] The unified framework serves a wide range of users across both domains:
 Farmers and smallholders wanting data-driven crop yield estimates before committing resources for the season.
 Government agricultural departments and food security agencies needing national or regional output predictions at scale.
 Agricultural extension officers and field agronomists who can use feature importance outputs to optimize field inputs.
 Commodity traders and agribusiness analysts tracking supply conditions and early signs of price pressure.
 Network administrators and security engineers monitoring real-time or historical traffic for intrusions.
 Cybersecurity Operations Centre (SOC) teams needing understandable anomaly scores for alert triage.
 Internet Service Providers (ISPs) and data centre operators protecting infrastructure from sophisticated attacks.
 Cloud and hosting providers managing security across large, dynamic network environments.
 Researchers studying climate-agriculture interactions or network behaviour patterns across diverse datasets.

Advantages of the Invention
[0021] The benefits of this unified invention include:
1. Unified Multi-Domain Architecture: A single modular AI engine serves both agricultural and network security domains. The standardized preprocessing pipeline and model selector reduce repeated infrastructure and lower deployment overhead, while the domain-routing API lets organizations use both capabilities through a single integration point.
2. Explainable AI Across Domains: The agricultural module provides ranked feature importance scores (rainfall 28.5%, temperature 22.1%, crop type 18.3%, soil quality 12.4%, pesticide usage 8.7%), helping farmers and agronomists understand and improve inputs. The network module offers hybrid anomaly scores with visualization, helping security analysts understand and manage alerts.
3. Hybrid Anomaly Detection: Combining Isolation Forest and K-Means clustering into a hybrid anomaly score increases robustness and reduces reliance on any single modelling assumption, which enhances the detection of various attack types, including zero-day threats not covered by signature-based systems.
4. Dual Ensemble Model Support: The agricultural module lets users choose between a Random Forest (consistent across different inputs) and an XGBoost (higher accuracy with clear data patterns). Both models are accessible at query time, providing practical value for research and comparison.
5. Adaptive Thresholding: The network module's dynamic thresholding adjusts the anomaly decision boundary to recent score distributions, automatically responding to changing traffic patterns and reducing false alarms over time.
6. Scalable REST API Architecture: The unified Flask-based REST API is not linked to any specific frontend or platform. It can be accessed from mobile applications, integrated into government advisory portals, connected to SIEM platforms, or called programmatically from any data pipeline using any language or framework. The domain-routing JSON header allows one integration to meet both operational needs.

Claims
Following are the claims of the invention:
1. A computer-implemented method for predicting agricultural crop yield within a unified multi-domain AI framework, the method including: receiving a set of agronomic and environmental parameters such as crop type, country, average annual rainfall in millimeters, average temperature in degrees Celsius, growing season, climate zone, soil quality index, field area in hectares, irrigation usage, fertilizer application rate in kilograms per hectare, soil pH level, and humidity percentage; encoding categorical input fields using pre-fitted Label Encoders stored as serialized artifacts; passing the encoded feature vector to a trained ensemble machine learning model selected from a Random Forest regressor or an XGBoost regressor; and returning a predicted yield value in hectograms per hectare along with a computed confidence interval and ranked feature importance scores.
2. The method of claim 1, where the ensemble machine learning model is either a Random Forest regressor with 100 decision trees and a maximum depth of 15 or an XGBoost regressor trained over 100 boosting rounds with a learning rate of 0.1. The user can select which model to use at query time through a unified API request parameter.
3. The method of claim 1 also includes calculating a total field yield by multiplying the predicted yield per hectare by the user-supplied field area. It also calculates a confidence interval where the lower bound equals 85% and the upper bound equals 115% of the predicted value.
4. The method of claim 1 also includes retrieving and returning pre-computed feature importance scores for each input variable ranked by percentage contribution. The main contributing features include average rainfall at about 28.5%, average temperature at about 22.1%, crop type at about 18.3%, soil quality index at about 12.4%, and pesticide usage at about 8.7%.
5. A computer-implemented method for network anomaly detection within a unified multi-domain AI framework, the method consisting of: (a) receiving network traffic records that include at least connection duration, protocol type, service, flag, source bytes, destination bytes, and host-level statistical features; (b) preprocessing the records by filling in missing values, encoding categorical attributes, and scaling numerical attributes; and (c) generating a feature vector representing behavioural Deep Packet Inspection characteristics for each record.
6. The method of claim 5 also includes training an Isolation Forest model on the feature vectors to compute an anomaly score and a binary indication of whether each record is normal or anomalous.
7. The method of claim 5 or 6 also includes training a clustering model, such as K-Means, on the feature vectors to assign each record to a cluster. It computes a distance between the record and the corresponding cluster centroid as an anomaly indicator.
8. A unified AI-driven multi-domain predictive system includes a domain-routing API gateway built with Flask. It receives JSON payloads and directs each request to either an Agricultural Yield Estimator module or a Network Traffic Anomaly Analyzer module based on a domain header field. It also includes a shared preprocessing pipeline that encodes categorical features, fills in missing values, and scales numerical inputs for both domain modules. Additionally, there is a standardized JSON response schema that provides domain type, prediction or anomaly result, confidence interval or anomaly score, model used, feature importance or anomaly visualization data, and a contextual insight message.

Abstract
The present invention presents a Unified AI-Driven Predictive Framework (UAIPF). This framework integrates two domain-specific machine learning systems: an Agricultural Yield Estimator and a Network Traffic Anomaly Analyzer. It operates within a single modular software architecture exposed through a Flask-based REST API.

The Agricultural Yield Estimator takes twelve agronomic and environmental parameters (crop type, country, rainfall, temperature, season, climate zone, soil quality, field area, irrigation, fertilizer rate, pH, humidity) and applies trained ensemble models—a Random Forest regressor (100 trees, max depth 15) and an XGBoost regressor (100 rounds, learning rate 0.1). Both models are trained on over 5,000 records from FAO and World Bank data. Predictions are presented in hectograms per hectare along with a confidence interval (85%-115%) and ranked feature importance scores, indicating that average rainfall (28.5%), temperature (22.1%), crop type (18.3%), soil quality (12.4%), and pesticide usage (8.7%) are the main contributors.

The Network Traffic Anomaly Analyzer processes network flow records (duration, protocol type, service, flag, source/destination bytes, host statistics) from benchmark datasets (NSL-KDD, CICIDS) or live streams. An Isolation Forest model provides primary anomaly detection, while a K-Means clustering model offers additional distance-based anomaly indicators. A hybrid anomaly score, which is a weighted combination of the normalized Isolation Forest score and normalized cluster centroid distance, is compared against either a static or a dynamically adaptive threshold to classify each record as NORMAL or ANOMALY.

The unifying concept of both modules is that diverse behavioural feature vectors, whether from field conditions or network packets, are processed through a shared preprocessing pipeline. These vectors are routed to domain-specific ensemble models via a JSON header in a single API endpoint, and results are returned as explainable, scored outputs. This unified architecture allows organizations to deploy one integrated AI system that addresses both food security and information security challenges.
, Claims:Following are the claims of the invention:
1. A computer-implemented method for predicting agricultural crop yield within a unified multi-domain AI framework, the method including: receiving a set of agronomic and environmental parameters such as crop type, country, average annual rainfall in millimeters, average temperature in degrees Celsius, growing season, climate zone, soil quality index, field area in hectares, irrigation usage, fertilizer application rate in kilograms per hectare, soil pH level, and humidity percentage; encoding categorical input fields using pre-fitted Label Encoders stored as serialized artifacts; passing the encoded feature vector to a trained ensemble machine learning model selected from a Random Forest regressor or an XGBoost regressor; and returning a predicted yield value in hectograms per hectare along with a computed confidence interval and ranked feature importance scores.
2. The method of claim 1, where the ensemble machine learning model is either a Random Forest regressor with 100 decision trees and a maximum depth of 15 or an XGBoost regressor trained over 100 boosting rounds with a learning rate of 0.1. The user can select which model to use at query time through a unified API request parameter.
3. The method of claim 1 also includes calculating a total field yield by multiplying the predicted yield per hectare by the user-supplied field area. It also calculates a confidence interval where the lower bound equals 85% and the upper bound equals 115% of the predicted value.
4. The method of claim 1 also includes retrieving and returning pre-computed feature importance scores for each input variable ranked by percentage contribution. The main contributing features include average rainfall at about 28.5%, average temperature at about 22.1%, crop type at about 18.3%, soil quality index at about 12.4%, and pesticide usage at about 8.7%.
5. A computer-implemented method for network anomaly detection within a unified multi-domain AI framework, the method consisting of: (a) receiving network traffic records that include at least connection duration, protocol type, service, flag, source bytes, destination bytes, and host-level statistical features; (b) preprocessing the records by filling in missing values, encoding categorical attributes, and scaling numerical attributes; and (c) generating a feature vector representing behavioural Deep Packet Inspection characteristics for each record.
6. The method of claim 5 also includes training an Isolation Forest model on the feature vectors to compute an anomaly score and a binary indication of whether each record is normal or anomalous.
7. The method of claim 5 or 6 also includes training a clustering model, such as K-Means, on the feature vectors to assign each record to a cluster. It computes a distance between the record and the corresponding cluster centroid as an anomaly indicator.
8. A unified AI-driven multi-domain predictive system includes a domain-routing API gateway built with Flask. It receives JSON payloads and directs each request to either an Agricultural Yield Estimator module or a Network Traffic Anomaly Analyzer module based on a domain header field. It also includes a shared preprocessing pipeline that encodes categorical features, fills in missing values, and scales numerical inputs for both domain modules. Additionally, there is a standardized JSON response schema that provides domain type, prediction or anomaly result, confidence interval or anomaly score, model used, feature importance or anomaly visualization data, and a contextual insight message.