Cybersecurity Threat Intelligence Using Machine Learning Classification Techniques

Abstract

New attacks are getting smarter and more sophisticated, so the old signature-based intrusion detection and prevention systems can't find them. This work proposes a machine learning approach to build a cybersecurity threat intelligence framework for effective multiclass intrusion detection, in which the Decision Tree classifier is used. The CICIDS2017 benchmark dataset, which contains both benign network traffic and several types of cyberattacks, is used to build and test the suggested model. The goal of the preparation process is to enhance classification performance by cleaning and separating data, utilizing Standard Scaler to scale features, and SMOTE to balance classes. Metrics like as recall, accuracy, precision, F1-score, confusion matrix, and ROC curve are used to test the Decision Tree model. An impressive 99.91% accuracy (ACC) rate, 97.79% precision (PRE), 97.08% recall (REC), 97.41% F1-score (F1), and 0.99 AUC were revealed by the experiment's outcomes. The suggested method beats state-of-the-art deep learning and ML approaches in terms of performance, execution time, and computational complexity. The results show that the suggested design is a reliable, efficient, and lightweight way to find cyber security threats and IDR apps with intelligence.