Boosting Cyberattack Detection with a Multi-Stage Machine Learning Approach
Bulut Karadağ Gökhan Kesin Sümeyye Alpay İsmet Köroğlu İsmail Fırat Çelik Gökhan Görmüş Aslıhan Çandır Fatih Alagöz
AbstractCyberattacks continue to become more frequent and sophisticated, posing serious threats to network security. The paper proposes a multi-stage machine learning approach for improving cyberattack detection and classification utilizing the CICIDS 2017 dataset, a comprehensive intrusion detection reference. The suggested technique is divided into three stages: anomaly detection using the One-Class Support Vector Machine (OC-SVM), attack categorization with CatBoost and LightGBM, and false-positive reduction to improve Zero-Day attack detection. The use of Principal Component Analysis (PCA) for dimensionality reduction and balanced data sampling guarantees that the model is robust and efficient. Results demonstrate that the CatBoost algorithm surpasses LightGBM in key measures, with an F1- weighted score of 0.97 and a Zero-Day recall rate of 0.91. A solution for real-world cybersecurity applications that advances the state of the art in machine learning-based intrusion detection systems.