Comparative Analysis of Machine Learning Algorithms for Cybersecurity Threat Detection

Thesis Abstract

Cybersecurity threats continue to evolve rapidly, posing significant risks to organizational integrity, data confidentiality, and operational continuity. Traditional signature-based detection methods have proven insufficient against sophisticated and zero-day attacks, necessitating the adoption of machine learning (ML) algorithms that offer adaptive, predictive, and automated threat detection capabilities. This study aims to conduct a comprehensive comparative analysis of prominent machine learning algorithms—specifically Random Forest (RF), Support Vector Machine (SVM), Artificial Neural Networks (ANN), and Gradient Boosting Machines (GBM)—to evaluate their effectiveness in cybersecurity threat detection. The specific objectives include assessing the accuracy, precision, recall, and F1-score of each algorithm, analyzing their computational efficiency, and identifying the most suitable model for real-time threat detection in network environments. The research adopts a quantitative, cross-sectional design centered on the collection and analysis of network traffic data labeled for various cyber threats, including malware, phishing, denial-of-service (DoS), and intrusions. The study population comprises network traffic logs from a simulated enterprise network environment with diverse attack scenarios, totaling approximately 50,000 data points. A stratified sampling technique was employed to ensure balanced representation of attack types, resulting in a final sample of 20,000 instances for model training and testing. Data collection involved extracting features such as packet size, flow duration, protocol type, and payload characteristics from packet captures (PCAP) files, processed through feature engineering techniques for optimal model input. Model training and evaluation utilized the Python-based Scikit-learn and TensorFlow libraries, with hyperparameter tuning conducted via grid search to optimize each algorithm's performance. The models' efficacy was assessed using standard classification metrics—accuracy, precision, recall, F1-score—and computational efficiency was measured through training and inference times. Additionally, receiver operating characteristic (ROC) curves and area under the curve (AUC) analysis provided a comparative measure of each model's discriminative ability. Analyses were performed employing statistical techniques such as Analysis of Variance (ANOVA) for performance comparisons and paired t-tests to evaluate the significance of differences among models. Expected findings include the identification of the most accurate and computationally efficient ML algorithms for detecting various cyber threats, with Anticipated results suggesting that ensemble methods like Random Forest and Gradient Boosting Machines will outperform individual classifiers in accuracy and robustness. It is also hypothesized that neural network-based models may offer superior adaptability but at the expense of higher training time. These results aim to provide empirical evidence to guide cybersecurity practitioners in selecting optimal ML models for real-time threat detection. This research contributes to the existing body of knowledge by systematically comparing multiple ML algorithms within a unified framework, highlighting their respective strengths and limitations in cybersecurity applications, and generating insights into their deployment feasibility in operational environments. By evaluating models on real network traffic data with diverse attack profiles, the study advances understanding of how various algorithms perform under realistic conditions, addressing existing gaps in the literature regarding comprehensive comparative analyses. In conclusion, the study underscores the importance of tailored machine learning solutions for cybersecurity threat detection and recommends the adoption of ensemble methods, particularly Random Forest and Gradient Boosting, for high-performance threat identification in enterprise networks. It further advocates for ongoing model refinement through adaptive algorithms and continuous data updates to maintain detection efficacy amid evolving cyber threats. The findings will serve as a foundation for future research exploring hybrid models and real-time implementation strategies, thereby supporting more resilient cybersecurity infrastructures.