# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Training Unsupervised ML Techniques
However, its performance can degrade in higher-dimensional spaces due to the curse of dimensionality, which may explain its slightly lower metrics compared to RFC and SVM. Despite this, KNN offers a balanced trade-off between precision and recall, making it a reliable general-purpose model for cybersecurity classification tasks. Logistic Regression delivered a solid performance with an accuracy of 0.939, precision of 0.951, recall of 0.941, and a corrected F1-Score of 0.946 (Table 5). As a linear model, Logistic Regression maintains high precision and recall, but it falls slightly behind non-linear models like RFC and SVM in overall performance. Its TPR of 0.94 and FPR of 0.05 \begin{table}
\begin{tabular}{l c c c c c c c c c c} \hline \hline
**Model** & **Accuracy** & **Precision** & **F1-Score** & **Recall** & **True Positive** & **True Negative** & **False Positive** & **False Positive** & **False Positive** \\  & & & & **(TP)** & **(TN)** & **(FP)** & **(FN)** & **Rate** & **Rate** \\ \hline Random Forest & 0.972 & 0.982 & 0.978 & 0.975 & 98 & 97 & 3 & 2 & 0.98 & 0.03 \\ K-Nearest Neighbors (KNN) & 0.963 & 0.960 & 0.960 & 0.961 & 95 & 96 & 4 & 5 & 0.95 & 0.04 \\ Logistic Regression & 0.939 & 0.951 & 0.946 & 0.941 & 94 & 95 & 5 & 6 & 0.94 & 0.05 \\ Gaussian Naive & 0.927 & 0.923 & 0.917 & 0.911 & 90 & 92 & 8 & 10 & 0.90 & 0.08 \\ Support Vector & 0.965 & 0.970 & 0.971 & 0.971 & 96 & 96 & 4 & 4 & 0.96 & 0.04 \\ Machine (SVM) & & & & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparative performance of five machine learning models. indicate reliable detection of true threats with a moderate rate of false alarms. Logistic Regression is advantageous for problems with linear decision boundaries and serves as an effective baseline for classification tasks in cybersecurity. However, its performance may be limited when dealing with complex, non-linear relationships in the data, which are common in real-world cybersecurity datasets. Gaussian Naive Bayes, despite its simplicity, achieved an accuracy of 0.927, the lowest among the evaluated models, with a precision of 0.923, a recall of 0.911, and a corrected F1-Score of 0.917 (Figure 4). This performance is attributed to its assumption of feature independence, which often does not hold in complex cybersecurity datasets. The model's higher FPR (0.08) and lower TPR (0.90) compared to the other models suggest that it generates more false positives and misses some true threats, making it less suitable for applications requiring minimal false alarms. Nevertheless, Gaussian Naive Bayes remains effective for straightforward datasets with minimal inter-feature dependencies, offering reasonable precision and recall for simpler classification tasks. Overall, the Random Forest Classifier stands out as the best model, with the highest accuracy, precision, recall, and F1-Score, alongside the lowest FPR, proving its effectiveness in complex and diverse cybersecurity classification tasks. SVM also performed exceptionally well, offering a strong alternative for scenarios where linear decision boundaries are insufficient, and its high recall makes it particularly adept at identifying true threats. KNN and Logistic Regression provide balanced trade-offs, with KNN excelling in smaller, distinct datasets and Logistic Regression serving as a reliable baseline for linear problems. Gaussian Naive Bayes, while fast and simple, is best suited for simpler data structures with independent features, as its performance lags in more complex scenarios. Figure 4: Supervised ML Techniques Scores. ### Unsupervised ML Techniques

The evaluation metrics (Precision, Recall, F1-score, and Accuracy) confirm the observations made from the confusion matrices. DBSCAN obtains the best scores in all metrics, underlining its robustness in detecting anomalies. K-means shows average results, while Isolation Forest, despite its detection capabilities, ranks last.