Multiclass Threat Detection with the Use of Machine Learning and Deep Learning Models

Vladislav Karyukin, Olga Ussatova, Aidana Zhumabekova, Kuanysh Zhumabekova, Nikita Ussatov, Yenlik Begimbayeva

2025

Closed access Metadata (CSL-JSON)
DOI 10.1109/opcs67346.2025.11219384
Data confidence 70 medium
How this score is calculated

It is built from checkable properties of the record itself: whether the article has a DOI, how many independent sources confirmed its data, whether the required fields are filled in, and how recent the latest confirmation is. Disagreement between sources and a missing identifier lower it. A value of 80 or above means the record was published without further checking; 60 to 79 means it is published at reduced confidence, with a manual check advisable. A record verified by an editor by hand is never pushed below 90 by a recalculation. This scores our data about the article, not the article itself.

Abstract

This research work focuses on detecting cyberthreats, including Malware, Man-in-the-Middle, and Distributed Denial-of-Service. Given the escalating complexity and frequency of cyber threats, traditional detection approaches struggle to provide adequate protection, underscoring the need for deep learning and machine learning strategies. This study evaluates and compares the performance of six prominent models: XGBoost, Random Forest, Support Vector Machine, Dense Neural Network, Convolutional Neural Network, and Long Short-Term Memory using the NF-UQ-NIDS-v2 Network Intrusion Detection Dataset. The dataset was meticulously preprocessed using the scaling technique and feature selection with the Chi-square method (selecting 20 features out of 43), as well as Random Oversampling to address class imbalance. Experimental evaluations utilize a group of classification metrics to evaluate the effectiveness of models. The received scores demonstrated that ensemble models, specifically Random Forest and XGBoost, significantly outperformed other classifiers, achieving nearly perfect metrics of 0.999, which reflects their exceptional capability to generalize across diverse attack types. In contrast, the Support Vector Machine demonstrated limited effectiveness, with an accuracy as low as 0.794, indicating its relative inefficiency in this scenario. Deep learning models have consistently shown strong performance with metrics ranging from 0.924 to 0.949. This study highlights the effectiveness of ensemble techniques in cybersecurity threat classification, offering valuable insights for enhancing proactive defense mechanisms in network security systems