# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Training Unsupervised ML Techniques
**Latency Requirement:** All evaluated models meet stringent SOC latency demands, with average inference times comfortably below the 100 ms threshold required for timely detection and response, as shown in Table 6.

**Latency Requirements:** All models meet the 100 ms hard real-time threshold: Random Forest (45 ms), SVM (48 ms), KNN (50 ms), Logistic Regression (40 ms), Gaussian Naive Bayes (35 ms), DBSCAN (62 ms), K-means (55 ms), and Isolation Forest (60 ms). Distributed processing on SOC workstations reduces central server load, ensuring scalability. **Continuous Model Updates:** An automated retraining pipeline monitors model drift weekly, triggering retraining if metrics (e.g., F1-Score < 0.85) drop. Retraining takes ~30 min, scheduled during low-activity periods. Incremental learning reduces retraining time by 20%, and models are deployed via/var/ossec/ml_detection/ML_Alerts.py. **Fault Tolerance and Scalability:** Redundant processing nodes and load balancing ensure robustness. A health-monitoring system tracks latency and resource utilization, alerting administrators if metrics exceed thresholds (e.g., latency > 100 ms). ### Analysis and Comparison

Analysis of the alerts.json dataset revealed a 3% increase in false negatives (from 4% to 7%) compared to rule-based Wazuh, primarily involving privilege escalation (73% of missed threats) during low-volume periods (68%). Analysis of the alerts.json dataset (15,427 events) revealed a 3% increase in false negatives using the ML-enhanced Wazuh system (rising from 4% to 7% compared to the rule-based baseline). These missed detections were predominantly privilege escalation attempts (73%) and occurred mostly during low-volume periods (68%). Although this increase in false negatives is a concern--particularly given that 39% were classified as high or critical impact--it is partially attributed to training bias, where severe but infrequent threats were underrepresented in the dataset. Despite this, our ML-enhanced approach achieved a substantial 78% reduction in false positives (from 23% to 5%), significantly improving analyst efficiency and reducing alert fatigue. We recognize that most organizations would prefer a higher false-positive rate over missing critical threats; hence, we introduced multiple mitigation strategies:

**Ensemble Model:** A combination of Random Forest, DBSCAN, and Isolation Forest using confidence-weighted voting reduced overall false negatives by 73% (down to 0.8%); \begin{table}
\begin{tabular}{p{42.7 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt}} \hline
**Event Volume (Events/ Second)** & **Metric** & **Random Forest** & **SVM (RBF Kernel)** & **SVM (Kernel)** & **KNN** & **DBSCAN** & **Logistic Regression** & **Gaussian Naive Bayes** & **Gaussian Naive Forest** \\ \hline
10 & Average Inference Time (ms) & 12.4 & 18.7 & 14.2 & 15.8 & 8.7 & 7.2 & 5.9 & 9.4 & 11.7 \\  & CPU Utilization (\%) & 1.8 & 2.4 & 2.1 & 1.9 & 1.2 & 1.1 & 0.8 & 1.4 & 1.6 \\
50 & Average Inference Time (ms) & 15.7 & 23.8 & 17.9 & 21.4 & 12.3 & 9.8 & 7.8 & 13.1 & 16.2 \\  & CPU Utilization (\%) & 2.3 & 3.2 & 2.8 & 2.7 & 1.8 & 1.5 & 1.2 & 2.0 & 2.3 \\
100 & Average Inference Time (ms) & 18.9 & 31.5 & 23.1 & 29.7 & 18.9 & 13.4 & 10.7 & 18.8 & 23.1 \\  & CPU Utilization (\%) & 3.1 & 4.9 & 3.9 & 4.1 & 2.9 & 2.2 & 1.8 & 3.1 & 3.5 \\
500 & Average Inference Time (ms) & 45.2 & 67.3 & 52.8 & 87.9 & 62.8 & 40.1 & 32.4 & 55.7 & 67.4 \\  & CPU Utilization (\%) & 7.8 & 12.1 & 9.7 & 14.2 & 8.7 & 6.4 & 5.2 & 8.9 & 10.2 \\ \hline \end{tabular}
\end{table} 
Table 6: Latency and Resource Utilization in Real-Time SOC Deployment.