# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Training Unsupervised ML Techniques  
In this section, we implement a preprocessing technique to improve the accuracy of clustering in a safety dataset. Clustering is a commonly used method to identify patterns and anomalies in data; however, it requires that all features be on the same scale to avoid favoring those with higher values. Standardization, which adjusts the data so that it has a mean of zero and a standard deviation of one, ensures that each feature contributes equally to the clustering algorithm. One of the key features of our dataset, Event Severity, represents the criticality of events, where higher values indicate more serious security incidents. To preserve the influence of this characteristic, we have chosen not to standardize it to maintain the weight of high-severity events in the clustering process. This method makes it possible to obtain more accurate clustering by ensuring that critical events are given the appropriate weight when identifying patterns or anomalies. The following (Algorithm 1) code shows the steps taken to scale the other features and combine them with weighted Event Severity to ensure balanced and relevant clustering results. ``` Input: Data (a dataset with features including 'Event Severity') Output: ScaledData (a dataset with standardized features and original 'Event Severity') 1.//Select features for standardization, excluding 'Event Severity' 2. FeaturesToStandardize \(\leftarrow\) Data.DropColumn('Event Severity') 3.//Standardize the selected features 4. Scaler \(\leftarrow\) InitializeStandardScaler() 5. ScaledFeatures \(\leftarrow\) Scaler.FitTransform(FeaturesToStandardize) 6.//Combine the standardized features with the original 'Event Severity' 7. ScaledData \(\leftarrow\) CreateDataFrame(ScaledFeatures, Columns \(\leftarrow\) FeaturesToStandardize.Columns) 8. ScaledData['Event Severity'] \(\leftarrow\) Data['Event Severity']
9. Return ScaledData

#### 3.7.1 K-Means

Before applying the K-Means clustering algorithm, it is essential to determine the optimal number of clusters, denoted as \(k\), as this parameter has a direct impact on the clustering quality. Choosing an inappropriate number of clusters can lead to suboptimal results, either by overfitting or underfitting the data structure. Overfitting occurs when an excessive number of clusters is specified, resulting in the model capturing noise and minor fluctuations in the data, thereby losing generalizability. Conversely, underfitting happens when too few clusters are used, which can cause important structures or natural groupings in the data to be overlooked. To systematically determine the appropriate value for k, two well-established techniques were applied: the Silhouette Score and the Elbow Method. The Silhouette Score provides a quantitative assessment of clustering quality by measuring the similarity of a data point to its cluster compared to other clusters. Scores range from \(-1\) to \(+1\), with higher values indicating that clusters are well-separated and internally cohesive. The silhouette analysis revealed that the clustering structure is most distinct when k = 2, suggesting that this value provides the clearest separation between groups. To complement this analysis, the Elbow Method was also utilized. This approach involves plotting the within-cluster sum of squares (WCSS) against various values of k. Initially, as \(k\) increases, the WCSS decreases sharply due to improved fit. However, after a certain point, the rate of decrease slows down significantly, forming an \"elbow\" in the plot. This inflection point marks a balance between minimizing intra-cluster distance and maintaining model simplicity, serving as a practical guide for selecting \(k\). Based on the results of the Silhouette Score, the number of clusters was set to 2. The K-Means model was initialized with this value of \(k\), and a fixed random_state of 42 was specified to ensure reproducibility of the clustering results.