# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Training Unsupervised ML Techniques
This model was then trained on the standardized dataset, allowing it to iteratively partition the data into the defined number of clusters by minimizing intra-cluster variance. Upon training, cluster assignments were generated for each data point. These assignments, which indicate the closest cluster centroid for each observation, were added to the dataset in a new column labeled cluster. To assess the distribution of data points within their respective clusters, the algorithm computed the Euclidean distances between each point and all cluster centroids using the transform method. The minimum of these distances--representing the proximity to the nearest cluster center--was stored in a new column named distance_to_centroid. To detect potential anomalies, a threshold was derived based on the 99.7 th percentile of the distance distribution. Any point whose distance exceeded this threshold was considered an outlier, as it significantly deviated from the typical intra-cluster distance pattern. These points were flagged in a new column named anomaly. This clustering-based anomaly detection approach proved effective in identifying outliers. By focusing on the uppermost 0.3% of data points in terms of distance to the nearest centroid, this model isolated observations that deviated notably from the core structure of the data, thereby enabling more targeted investigations into these atypical instances. #### 3.7.2 Isolation Forest

Isolation Forest is an unsupervised learning algorithm specifically designed for anomaly detection [22]. Unlike clustering-based techniques, it does not attempt to model normal instances but rather isolates anomalies directly. The underlying assumption is that anomalies are few and different, making them easier to separate from the rest of the data. The algorithm constructs multiple isolation trees by randomly selecting a feature and a split value. Since anomalies are rare and often exhibit attribute values that differsignificantly from normal observations, they are typically isolated closer to the root of the tree, resulting in shorter path lengths. Conversely, normal points usually require more partitions to be isolated, leading to longer path lengths. The Isolation Forest model was initialized with a contamination parameter set to 0.01, indicating that approximately 1% of the dataset is expected to be anomalous. This value influences the threshold used for anomaly detection. To ensure consistent and reproducible results, the random seed was fixed using a specific value. Once initialized, this model was trained on the preprocessed dataset. During this process, it assigned a prediction label to each data point: \(-\mathbf{1}\) for anomalies and \(\mathbf{1}\) for normal observations. These predictions were stored in a dedicated column labeled _anomaly_ in the dataset, facilitating the identification of unusual behaviors. After training and prediction, the dataset was filtered to retain only those instances labeled as anomalies. These entries, identified as having a significantly shorter average path length across the isolation trees, were extracted and compiled into a separate dataset for further analysis. This method allowed for the efficient detection of outliers based on their isolation characteristics without requiring any assumptions about the underlying distribution of the data. The results demonstrated the effectiveness of Isolation Forest in identifying subtle and potentially high-impact anomalies that may escape traditional clustering-based approaches. #### 3.7.3 Dbscan

DBSCAN (Density-Based Spatial Clustering of Applications with Noise) is an unsupervised clustering algorithm that identifies dense regions in data and treats low-density regions as anomalies or noise [23]. It is particularly effective for discovering clusters of arbitrary shape and for distinguishing outliers in datasets with varying densities.