# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Training Unsupervised ML Techniques
To discuss performance metrics based on the provided code snippet, we must understand how each metric evaluates a machine learning model's performance, especially in classification tasks. Table 4 shows the performance metrics with their explanations and corresponding equations. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Metric** & **Description** & **Calculation** \\ \hline True Positive Rate (TPR) & Sensitivity or Recall: Fraction of actual positives & \(TPR=\left(\frac{TP}{FN}\right)\) \\ False-Positive Rate (TNR) & Specificity: Fraction of actual negatives incorrectly & \(FPR=\left(\frac{FP}{FP+TN}\right)\) \\  & classified as positive. & \(Precision=\left(\frac{TP}{TP+FP}\right)\) \\ Precision & Fraction of instances correctly classified by & \(Accuracy=\left(\frac{TP}{TP+FP}\right)\) \\ Accuracy & Fraction of instances correctly classified by & \(Accuracy=\left(\frac{TP}{TP+FP}\right)\) \\ Recall & The percentage of correct positive predictions out & \(Accuracy=\left(\frac{TP}{TP+FN}\right)\) \\  & of all the positive values. & \(F1=\left(\frac{2\times Precision\times Recall}{Precision+Recall}\right)\) \\ F1-Score & This is the weighted harmonic mean of precision & \(F1=\left(\frac{2\times Precision\times Recall}{Precision+Recall}\right)\) \\  & and recall. & \(\left[\begin{matrix}TP&FN\\ FP&TN\end{matrix}\right]\) \\ Confusion matrix & It shows the number of correct predictions (TP and TN) and incorrect predictions (FP and FN). & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance metrics with their explanations and corresponding equations. ### Supervised ML Techniques

Table 5 outlines the comparative performance of five machine learning models (Random Forest, K-Nearest Neighbors, Logistic Regression, Gaussian Naive Bayes, and Support Vector Machine) using common evaluation metrics: accuracy, precision, true positive, true negative, false positive, false negative, true positive rate (TPR), and false-positive rate (FPR). Each metric provides insight into different aspects of the model's performance on a classification task. The Random Forest Classifier (RFC) emerged as the top-performing model, achieving an accuracy of 0.972, as shown in Table 4. RFC also demonstrated high precision (0.982) and recall (0.975), resulting in a corrected F1-Score of 0.978, reflecting its ability to effectively balance the minimization of false positives and false negatives. The model's low false-positive rate (FPR) of 0.03, coupled with a high true-positive rate (TPR) of 0.98, underscores its reliability in avoiding false alarms while accurately detecting true threats. This performance highlights RFC's robustness in handling complex, high-dimensional data structures, making it an ideal choice for high-stakes cybersecurity scenarios, where minimizing false positives is critical, such as in threat detection systems. The Support Vector Machine (SVM) followed closely, with an accuracy of 0.965, a precision of 0.970, a recall of 0.971, and a corrected F1-Score of 0.971. SVM's performance reflects its strength in handling high-dimensional data with clear boundaries, as evidenced by its competitive TPR of 0.96 and FPR of 0.04. Although its TPR is slightly lower than RFCs, SVM excels in recognizing true positive cases, making it a strong contender for cybersecurity applications where data classes are well-separated. However, its minor shortfall in TPR compared to RFC suggests that SVM might miss some true threats in scenarios with overlapping or highly complex data distributions. Nonetheless, SVM remains a viable alternative to RFC, particularly in tasks requiring efficient classification in high-dimensional spaces. K-Nearest Neighbors (KNN) achieved an accuracy of 0.963, with a precision of 0.960, a recall of 0.961, and a corrected F1-Score of 0.960 (Table 5). While KNN demonstrates good performance, its FPR of 0.04 is slightly higher than RFC and SVM, indicating a potential for more false alarms. KNN is well-suited for smaller datasets with distinct patterns, as it relies on proximity-based classification.