Developing Efficient Machine Learning Algorithms for Anomaly Detection in Network Traffic for Cybersecurity

In this study, efficient machine learning algorithms to detect network traffic anomalies are developed to enhance the current cybersecurity systems. The conventional rule-based intrusion detection is not able to detect the changing and unknown attacks, making it necessary to adopt adaptive and data-driven solutions. In this study, the systematic preprocessing with the NSLKDD benchmark dataset, exploratory analysis and implementation of the supervised and unsupervised models, Decision Tree, Random Forest and K-Means clustering are applied. Accuracy, precision, recall, F1-score, ROC-AUC and purity measures are used to evaluate model performance. It has been found that supervised models vastly outperform the unsupervised methods and that the results of the random forest are nearly perfect in detecting and having exceptional discriminatory ability. K-Means showed mediocre clustering as well as poor ROC. All in all, the results reveal that optimised supervised learning, in this case, Random Forest, is a very capable and computationally efficient approach to anomaly detection in networks and enhancing real-time systems of intrusion detection.