Machine Learning Model Approach in Cyber Attack Threat Detection in Security Operation Center
10.11591/csit.v6i1.p%p
Muhammad Ajran Saputra
,
Deris Stiawan
,
Rahmat Budiarto
Traffic anomalies represent unstable states in network traffic that can make the network vulnerable to attacks or even paralyze it, often caused by parts of files targeted by intruders. The Indonesian National Cyber and Crypto Agency reported in April 2023 that 27,476,788 anomalous traffic incidents entered Indonesia each month, with the highest daily anomalous traffic reaching 1,600,334 incidents. One strategy to prevent or mitigate cyberattacks is through analyzing and detecting log anomalies using machine learning models. This study employs two machine learning models: the Naïve Bayes model with Multinomial, Gaussian, and Bernoulli variants, and the Support Vector Machine (SVM) model with Radial Basis Function (RBF), Linear, Polynomial, and Sigmoid kernel variants. The hyperparameters in both models are then optimized. The models with optimized hyperparameters are subsequently trained and tested. The experimental results indicate that the best performance is achieved by the RBF kernel SVM model, with an accuracy of 79.75%, precision of 80.8%, recall of 79.75%, and F1-score of 80.01%; and the Gaussian Naïve Bayes model, with an accuracy of 70.0%, precision of 80.27%, recall of 70.0%, and F1-score of 70.66%. Overall, both models perform relatively well and are classified in the very good category (75% - 89%).
