# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Training Unsupervised ML Techniques
**Contextual Enrichment:** Incorporating temporal correlation and external threat intelligence reduced critical false negatives by 91%, with only a 0.2% increase in false positives (to 5.2%);

**Risk-Based Thresholding:** We applied adaptive sensitivity thresholds--lower for critical assets to reduce missed attacks and higher for non-critical systems to manage workload--achieving a practical trade-off between detection and operational overhead. To validate the overall improvement, we compared the ML-enhanced and rule-based Wazuh systems on the same dataset. The results are summarized in Table 7.

To contextualize our approach within the current state of the art, we compared our approach with four state-of-the-art ML-based threat detection systems from the recent literature:

- [PERSON] et al. (2023) [11]: Our approach achieves comparable accuracy (99.1% vs. 99.7%) but with significantly lower computational requirements;

- [PERSON] et al. (2022) [10]: Our system shows better generalization to novel attacks (85% vs. 72% detection rate);

- APIRO ([PERSON] et al., 2023) [13]: While APIRO achieves higher API recommendation accuracy, our system provides more comprehensive threat coverage;

- DecOr ([PERSON] et al., 2022) [13]: Our approach demonstrates better scalability with increasing log volumes. This comparative analysis demonstrates that our ML-enhanced Wazuh system offers significant improvements over traditional rule-based detection while remaining competitive with or exceeding the performance of other state-of-the-art approaches in the literature. Table 8 presents this comparison with five recent studies on ML-based log analysis. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Metric** & **Rule-Based Wazuh** & **ML-Enhanced Wazuh** \\ \hline False-Positive Rate & 23\% & 5\% (78\% reduction) \\ False-Negative Rate & 4\% & 7\% (3\% increase) \\ Overall Accuracy & 76\% & 99\% (23\% improvement) \\ F1-Score & 0.72 & 0.97 (35\% improvement) \\ Detection Speed for Complex Attacks & Baseline & 18\% faster \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Performance Comparison of Rule-Based and ML-Enhanced Wazuh Detection Systems. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Study** & **Algorithms** & **Performance Metrics** & **Key Differences** \\ \hline \multirow{4}{*}{[PERSON] et al. (2023) [6]} & \multirow{4}{*}{Decision Trees} & \multirow{4}{*}{\
\begin{tabular}{l} Accuracy: 99.7–99.9\%, \\ F1-Score: 0.98 \\ \end{tabular} } & \multirow{4}{*}{
\begin{tabular}{l} Demonstrates high accuracy but requires \\ significant computational resources and lacks \\ adaptability to evolving threats due to \\ reliance on static decision trees. \\ Effective for novel attack mitigation in \\ simulated environments but exhibits limited \\ efficacy against zero-day threats, with \\ performance constrained by training \\ data quality. \\ Focuses on automated API recommendations \\ for SOAR platforms, offering limited \\ applicability to comprehensive threat \\ detection across diverse log datasets. \\ Provides structured incident response but \\ demonstrates reduced efficiency as log \\ volumes increase, limiting its suitability for \\ large-scale SOC deployments. \\ Employs different supervised/unsupervised \\ frameworks optimized for integration with \\ Wazuh, achieving a false-positive rate of 0.03 \\ with RF and 0.0821 with DBSCAN, tailored \\ for real-time threat detection in SMEs. \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Comparative Analysis of ML-Based Log Analysis Algorithms. Our approach leverages a hybrid framework integrating supervised (Random Forest) and unsupervised (DBSCAN, Isolation Forest) algorithms, achieving an accuracy of 0.972 and an F1-Score of 0.978. This performance is complemented by a reduced false-positive rate (0.03 for RF, 0.0821 for DBSCAN), enhancing alert management efficiency within the Wazuh SIEM system.