# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Training Unsupervised ML Techniques
The bar charts of the evaluation metrics highlight the superiority of DBSCAN, positioning this algorithm as the preferred choice for our use case. This analysis shows that DBSCAN is the most effective at minimizing misclassification and detecting anomalies compared to the other algorithms in this simulation, as illustrated in Figure 5.

#### Confusion Matrix

We compared the performance of three anomaly detection algorithms, DBSCAN, K-means, and Isolation Forest, using sample logs, as shown in Figure 6. Confusion matrices were designed to reflect the accuracy levels of the algorithms. The results show that DBSCAN outperforms both K-means and Isolation Forest. DBSCAN outperformed with a higher number of True Positives (TP) and a lower number of False Positives (FP), indicating its effectiveness in correctly identifying anomalies while minimizing false alarms. In comparison, K-means shows an intermediate performance with moderate levels of TP and FP, while Isolation Forest, although functional, shows the weakest performance of the three, with fewer TPs and more FPs. Figure 5: Unsupervised ML Techniques Scores. ### Practical Considerations for Real-Time Deployment

Deploying ML-enhanced Wazuh in real-time Security Operations Center (SOC) environments involves addressing critical factors such as computational overhead, latency constraints, continuous model updates, and fault tolerance. These considerations ensure that machine learning models maintain high detection accuracy without compromising operational efficiency or responsiveness. **Computational Overhead:** Our evaluation of enterprise-grade infrastructure (e.g., Dell PowerEdge R740 servers with Intel Xeon Gold 6248R processors and 128 GB RAM) established upper-bound resource utilization for all algorithms under ideal conditions. However, practical deployments must consider the resource capabilities of typical SOC workstations and server nodes:

* **Random Forest**: Demonstrated excellent scalability and parallelism, utilizing approximately 120 MB of memory and under 5% CPU on a 24-core server while sustaining real-time processing at event rates up to 500 per second. Its ensemble architecture leverages multicore processing to optimize throughput;
* **Support Vector Machine (SVM)**: Requires about 150 MB of memory and 6% CPU, benefiting from server-grade floating-point computation for kernel operations. Performs best on clearly separable data patterns typical in cybersecurity;
* **K-Nearest Neighbors (KNN)**: Lightweight at roughly 100 MB memory and 4% CPU, but computationally intensive in high-dimensional feature spaces due to distance calculations. Efficient indexing and data structures are essential to maintain performance;
* **Logistic Regression**: The minimal footprint (80 MB memory, 3% CPU) makes it suitable for resource-constrained scenarios. It excels at linearly separable problems but struggles with complex threat patterns;
* **Gaussian Naive Bayes**: Lowest resource use (70 MB memory, 2% CPU) but limited by its independence assumption, impacting detection accuracy in correlated feature environments;
* **DBSCAN:** Notably efficient during inference (50 MB memory, 2% CPU), optimized for distributed or parallel processing architectures. Ideal for unsupervised anomaly

Figure 6: Confusion Matrix. detection on streaming event data. Training phases are offloaded to centralized servers, while inference runs on SOC workstations with minimal overhead;
* **K-means and Isolation Forest:** Both lightweight (60 MB and 65 MB memory; 3% CPU) but prone to higher false positives in real-time, reducing analyst trust and practical usability despite good computational efficiency.