Application of Machine Learning Tools for Cyberattack Detection

Bruno Holzwarth Nunes de Carvalho; Adriano de Freitas Fernandes

DOI: 10.22167/2675-6528-202602736

Article derived from a Course Conclusion Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by Instituto Pecege for textual synthesis and organization.

Summary

The technological evolution and the popularization of the internet have intensified the strategic importance of data, but have also resulted in more sophisticated and costly cyberattacks. In this context, monitoring behavioral and origin patterns has become essential for resilience against evasion tactics. The work aimed to achieve high accuracy in intrusion detection through machine learning models based on user habit events on websites. A dataset with 9,357 log records was used, which underwent cleaning, null data treatment, normalization, and categorical variable encoding. Statistical diagnostics, such as Pearson’s Correlation Coefficient and Student’s t-test, were performed for attribute selection. Subsequently, Logistic Regression, Decision Tree, and Gradient Boosting algorithms were trained, with hyperparameter optimization via Grid Search. Gradient Boosting emerged as the best-performing model, achieving an accuracy of 0.887 and an ROC-AUC of 0.878. The classifier correctly identified 640 attack instances in the test set, demonstrating an ideal balance between precision and sensitivity. It was concluded that the integration of behavioral signals with ensemble algorithms is an effective strategy for anomaly detection in virtual environments. The model demonstrated high generalization capacity and stability, validating its applicability for real-time security monitoring.

Keywords: Machine Learning; Cybersecurity; User Behavior; Intrusion Detection; Gradient Boosting.

1. Introduction

The 1990s marked a period of global transformation with the advent of the World Wide Web, a project conceived by Tim Berners-Lee at CERN, in Geneva, Switzerland (Miranda, 2024). This innovation drove the unification of the world in terms of information and knowledge sharing, dissolving geographical barriers and popularizing the internet. Emails, chat rooms, and social networks emerged as new spaces for virtual interaction (Lins, 2013). With the fourth industrial evolution, characterized by elements such as cloud computing, the Internet of Things (IoT), and artificial intelligence (Mendonça et al., 2018), the data market consolidated itself as a strategic asset, often referred to as the “new oil”, requiring organizations to be data-driven to optimize their performance.

However, the growing dependence on data and the expansion of the digital environment are not without vulnerabilities. Cyberattacks, perpetrated by malicious individuals known as hackers, represent a constant threat, capable of interfering with, altering, stealing sensitive information, and even paralyzing business operations. The complexity and cost of these attacks are significant; IBM’s 2025 Cost of Data Breach Report indicates that 45% of data breaches in the early 2000s were caused by lost or stolen devices (IBM, 2025).

With the evolution of artificial intelligence, cyberattacks have become even more sophisticated and difficult to detect. One example is Data Poisoning, where harmful data is injected into training bases of AI tools, resulting in compromised confidential information. The average global cost to mitigate these attacks is US$4.44 million per breach, highlighting the urgency to develop effective practices to combat these new security infringement approaches, including the integration of AI security and governance in companies (IBM, 2025).

In this context, threat detection cannot be restricted to the analysis of signatures of already known attacks. Continuous monitoring of behavioral and origin patterns is imperative (Alsheri, 2023). Variables such as IP address reputation are crucial for identifying connections from sources associated with botnets or spam (Shewale and Deshpande, 2021). Similarly, monitoring access at unusual times serves as a warning for intrusion attempts that exploit periods of lower vigilance (Sperotto, 2010). The integration of these indicators enhances the resilience of security systems, and Machine Learning tools emerge as effective solutions for identifying malicious behaviors (Souza and Arima, 2024).

The need to monitor behavioral and origin patterns is fundamental for resilience against stealthy evasion tactics, justifying the relevance of this research. The general objective of this work is to develop and validate high-performance Machine Learning models for the assertive detection of cybernetic attacks, based on the analysis of behavioral patterns and users’ digital habits on websites to ensure a robust discriminatory capacity between legitimate traffic and intrusion attempts.

2. Material and Methods

The research was characterized as a study of a quantitative nature and applied approach, focused on the development and validation of Machine Learning models for the detection of cybernetic attacks. The empirical object consisted of a secondary database, obtained through the Kaggle platform, containing user behavior logs in virtual environments. This dataset totaled 9,357 records and 11 original variables, covering user behavioral information and internet traffic statistics.

Technical variables included network packet size, communication protocol type (TCP, UDP, and ICMP), encryption method used (AES, DES, and none), and browser type. Within user behavior and security, monitored items were login attempts, number of authentication failures, total session duration, IP address reputation score, and occurrence of access at atypical times. The target variable for supervised machine learning was attack detection, a binary classification where 0 indicated absence and 1 indicated presence of an attack.

After loading, the data underwent a data cleansing and quality diagnostic process. The presence of 1,966 null records was identified in the encryption_used variable (20.61% of the sample). For treatment, the one-hot encoding method was applied, which converted the categories into binary variables, treating null values as the absence of security patterns and preserving the data volume. Outliers in six numerical columns, such as access at unusual hours (14.99%) and login failures (3.39%), were maintained as potential threat signals, not being treated as collection errors.

To enable computational processing, the StandardScaler method was used to normalize the data, adjusting the scale of the variables to a mean of zero and unit variance. The dataset was then divided into three subsets for robust validation: 64% for training, 16% for validation, and 20% for testing, maintaining the proportion of the target variable at all stages. For feature selection, statistical diagnostic procedures were performed, including the Pearson Correlation Coefficient and the Student’s t-test.

The Pearson Correlation Coefficient assessed the linear relationship between numerical attributes and the target variable, revealing that login failures, login attempts, and IP reputation score showed relevant correlations. The Student’s t-test confirmed that login failures and IP score had clear statistical distinctions (p-value < 0.05) between legitimate and malicious traffic groups. For categorical variables, the Chi-Squared Test of Independence was used, which validated the statistically significant dependence of browser type on the target variable (p-value of 1.5983e-36). The final selection of attributes prioritized indicators that combine intent and context.

In the development of Machine Learning models, Logistic Regression, Decision Tree, and Gradient Boosting algorithms were implemented. The scripts were developed in Python, with the assistance of generative artificial intelligence Claude (Anthropic) for coding and parameter suggestion. The training set, composed of 6,103 records, was used to generate the internal weights of the algorithms. Hyperparameter optimization was performed via Grid Search with cross-validation (5-fold), testing 96 distinct combinations. For the Gradient Boosting model, the optimized parameters included a learning rate of 0.05, a maximum depth of 6, a number of estimators of 100, and a minimum number of samples for splitting of 15. The F1-Score was the main optimization criterion.

To evaluate the effectiveness of the models, performance metrics such as accuracy, precision, sensitivity, F1-Score, and the area under the ROC curve (AUC) were employed. 5-fold cross-validation ensured the generalization capability of the models across different data partitions. Confusion matrices were generated to quantify false positives and false negatives, and the ROC curve was used to visualize the classifiers’ performance at different decision thresholds, consolidating the choice of the model with the best predictive balance.

3. Results and Discussion

This section details the results obtained in the research and discusses them in light of the objective to develop high-performance machine learning models for the detection of cyberattacks, based on behavioral patterns and users’ digital habits. The findings reveal the effectiveness of Machine Learning approaches, especially ensemble algorithms, in identifying anomalies in virtual environments. The analysis ranges from the characterization of the database to the comparative performance of the models, including attribute selection and the interpretation of evaluation metrics, consolidating the discriminatory capacity between legitimate traffic and intrusions.

Descriptive Database Analysis

The database used for the study comprised 9,537 user behavior log records in virtual environments, providing a substantial volume for security analysis. The target variable, `attack_detected`, which indicates the presence or absence of an attack, showed a distribution of 5,273 records (55.29%) classified as legitimate access and 4,264 records (44.71%) identified as cyberattacks. This proportion, approximately 1.2:1 between normal traffic and attack, is considered statistically balanced for training supervised machine learning models.

In real-world network monitoring scenarios, severe imbalance is commonly observed, where attacks represent a minimal fraction of the total traffic, often less than 1%. The balanced distribution found in this study, with a significant presence of 44.71% attack records, allowed classification algorithms, such as Gradient Boosting, to robustly learn the characteristics of both classes. This characteristic avoided the need to apply artificial sampling techniques, such as oversampling or undersampling, to balance the classes during model training, simplifying the process and ensuring the representativeness of the original data.

The analysis of intrusion reasons within the attack group revealed a predominance of the TCP protocol, which was the most frequent, corresponding to 2,963 records (69.49%). Next, the UDP protocol was responsible for 1,092 records (25.61%) and ICMP for 209 records (4.90%). This percentage distribution of cyberattacks by communication protocol type highlights TCP as the main vector of malicious activities in the dataset. The prevalence of TCP in malicious activities reinforces the need for defense mechanisms focused on connection vulnerabilities and long-duration sessions, which are characteristics of this protocol.

Data Quality Diagnosis and Processing

The data diagnosis and cleaning process was crucial to ensure the quality and integrity of the dataset. The initial analysis identified the presence of 1,966 null records in the `encryption_used` variable, which corresponds to 20.61% of the total sample. In the context of cybersecurity, the absence of information about encryption can be a relevant indicator, suggesting intentionally unencrypted traffic or logs from legacy systems. To handle these null values and avoid biases in training, the One-Hot Encoding technique was applied, converting the categories (AES and DES) into binary variables and treating nulls as the absence of both security standards, thus preserving the data volume.

Statistical anomaly detection revealed the presence of outliers in six numerical variables of the dataset. The `unusual_time_access` variable was the most impacted, with 1,430 atypical cases, representing 14.99% of the data. Other variables with significant outlier rates included `session_duration` (4.38%) and `failed_logins` (3.39%). In an intrusion detection scenario, these extreme values were not considered collection errors, but rather active threat signals. For example, sessions with extreme duration, reaching up to 7,190 seconds, or peaks in authentication failures are typical behaviors of brute-force attacks or data exfiltration, justifying the retention of this data so that models could learn the boundaries of malicious traffic.

To enable computational processing and ensure that the disparity between the numerical scales of the variables did not generate bias, the One-Hot Encoding method was used to transform categorical variables such as `protocol_type`, `encryption_used`, and `browser_type` into metric variables. This procedure expanded the dataset from 11 to 18 columns, allowing for more detailed analysis. Additionally, the StandardScaler method was applied for data normalization, adjusting the scale of the variables to zero mean and unit variance. This standardization was important for the pipeline, even though tree-based models are not as sensitive to scale, ensuring that variables with lower magnitude but high statistical significance had the same predictive weight as attributes with high raw values.

Finally, to ensure robust validation of the results, the dataset was divided into three subsets: training (64%), validation (16%), and testing (20%). This division was performed to ensure that the proportion of the target variable was maintained in all stages of the experimentation. Maintaining the proportion of the target variable in each subset is fundamental to prevent the model from being trained with a class bias, which could compromise its generalization ability and its performance on unseen data.

Results of Statistical Procedures and Attribute Selection

The application of inferential and diagnostic statistics procedures was fundamental to scientifically validate the variables with the greatest discriminatory power in detecting anomalies. The Pearson Correlation Coefficient revealed that behavioral variables presented the strongest associations with the occurrence of attacks (`attack_detected`). The number of failed logins (`failed_logins`), with a coefficient of 0.3637, and login attempts (`login_attempts`), with 0.2773, stood out. These results corroborate the premise that authentication behavior is one of the clearest signs of intrusion attempts, such as brute-force attacks or credential stuffing, providing a solid basis for the inclusion of these variables in predictive models.

Student’s t-test for independent samples confirmed the statistical significance of the numerical variables. Login failures showed the highest statistical significance, with a p-value of 3.44e-296, followed by access attempts (p-value of 5.98e-168) and IP reputation score (p-value of 6.24e-97). The average number of login failures for accesses with attack was 1.9360, compared to 1.1796 for accesses without attack. For login attempts, the average with attack was 4.6374, versus 3.5426 without attack. IP reputation with attack had an average of 0.3730, while without attack it was 0.2976. These results demonstrate clear and statistically significant differences between the legitimate and malicious traffic groups, validating the inclusion of these indicators in the models.

The statistical relevance of IP reputation indicates that the connection origin history is a robust predictor, allowing the model to identify traffic from known malicious infrastructures in advance. In contrast, technical variables such as `network_packet_size` and `unusual_time_access` did not show statistically significant mean differences in this specific sample, with p-values of 0.506 and 0.398, respectively. The mean network packet size was 498.9311 with attack and 501.6433 without attack. For unusual time access, the mean with attack was 0.1534 and without attack 0.1472. These results suggest that, in isolation, these factors may not be sufficient for attack classification, although they may contribute in conjunction with other attributes.

Regarding categorical variables, the Chi-Squared Test of Independence validated that the browser type (`browser_type`) had a statistically significant dependence with the target variable, with a p-value of 1.5983e-36. On the other hand, the communication protocol (`protocol_type`) and encryption (`encryption_used`) variables, when analyzed in isolation, did not reach the significance threshold of 0.05 in the studied sample, with p-values of 2.2985e-01 and 1.6237e-01, respectively. This statistical synthesis underpinned the final selection of attributes, prioritizing indicators that combine intent (login failures) and context (IP reputation and browser type), ensuring that the models focused on threat signals with greater scientific validity and discriminatory power.

Comparative Performance of Models

The experimental evaluation compared the effectiveness of Logistic Regression, Decision Tree, and Gradient Boosting algorithms in the task of intrusion classification, evidencing significant performance disparities. The Logistic Regression model, established as a statistical baseline, presented the most modest performance on the test set, with an accuracy of 0.716 and an F1-Score of 0.717. Residual analysis of this model revealed non-random distributions, statistically proving the inadequacy of a linear decision boundary to capture the complexity of modern cyber threats. Its area under the ROC curve (AUC) was 0.7869, indicating a moderate discriminatory capacity.

The confusion matrix of the Logistic Regression model on the test set revealed that 768 legitimate accesses were correctly classified (true negatives), while 287 legitimate accesses were erroneously classified as attacks (false positives). Regarding attacks, 599 instances were correctly identified (true positives), but 254 attacks were incorrectly classified as legitimate (false negatives). The accuracy of the Logistic Regression model on the training, validation, and test sets was 0.7323, 0.7392, and 0.7165, respectively, indicating reasonable consistency, but with lower performance than more complex models.

On the other hand, the Decision Tree demonstrated substantial evolution in predictive capability, reaching an accuracy of 0.8816 on the test set. This qualitative leap indicates that the algorithm’s hierarchical decision structure is better suited to mapping the conditional rules that separate legitimate access from malicious activities. The accuracy of the Decision Tree on the training and test sets was 0.8987 and 0.8816, respectively, showing good performance and generalization capability. This improvement is due to the ability of decision trees to capture non-linear interactions between variables, which is crucial in cybersecurity scenarios.

The Gradient Boosting (GB) algorithm has consolidated itself as the highest-performing solution, achieving an accuracy of 0.887 on the test set and surpassing the other models in all evaluation metrics. The superiority of Gradient Boosting is attributed to its Ensemble Learning nature, which combines multiple weak decision trees to form a robust classifier. This approach is capable of mapping complex non-linear interactions between variables, such as the correlation between login failures and IP reputation, which are difficult to capture by linear models. While linear models fail in uncertainty zones where legitimate traffic and intrusions overlap, GB demonstrated superior effectiveness in capturing these behavioral nuances, ensuring more resilient detection against stealthy attacks.

Analysis of Metrics, Confusion Matrix and AUC-ROC

The detailed analysis of performance metrics for the final Gradient Boosting model revealed an ideal statistical balance for cybersecurity operations. The model achieved a ROC-AUC of 0.878 on the test set, indicating a high discriminatory capacity between legitimate traffic and intrusion attempts. In the context of threat detection, this metric proves that the algorithm maintains high performance regardless of the adopted classification threshold, minimizing the area of uncertainty in network diagnostics. The ROC-AUC on the training, validation, and test sets was 0.963, 0.885, and 0.878, respectively, demonstrating consistency and high discriminatory capacity.

The F1-Score of 0.884 on the test set consolidated the classifier’s robustness by balancing a precision of 0.906 with a sensitivity (recall) of 0.887. The F1-Score on the training, validation, and test sets was 0.899, 0.898, and 0.884, respectively, evidencing a good balance between attack detection and prediction reliability. The model’s precision on the training, validation, and test sets was 0.916, 0.913, and 0.906, respectively, indicating the proportion of true positives among all positive predictions. The model’s recall on the training, validation, and test sets was 0.901, 0.900, and 0.887, respectively, showing the model’s ability to correctly identify all attack instances.

The analysis of the confusion matrix of the Gradient Boosting model on the test set allowed for a practical visualization of these results. The model correctly identified 1,053 legitimate accesses (true negatives) and 640 attack instances (true positives). Only 2 legitimate accesses were erroneously classified as attacks (false positives), and 213 attack instances were incorrectly classified as legitimate (false negatives). For information security, the achieved sensitivity is a critical indicator, as it reflects the system’s effectiveness in not allowing malicious activities to go unnoticed, which represent the greatest risk to the integrity of organizational data. The low rate of false positives and false negatives demonstrates the model’s robustness.

Additionally, the model robustness was refined through hyperparameter optimization via Grid Search with cross-validation (5-fold), which allowed testing 96 distinct combinations to maximize the F1-Score. The optimized configuration for Gradient Boosting — composed of a learning rate of 0.05, maximum depth of 6, and 100 estimators — achieved an average F1-Score of 0.8934 in the validation step. On the test set, the optimized model maintained solid performance with a precision of 0.9057 and an accuracy of 0.8863. The overfitting analysis revealed a difference of only 0.0120 between the training and test F1-Scores, which proves the algorithm’s high generalization capability and its stability with new data. This fine-tuning process consolidated the classifier’s reliability, making it suitable for critical real-time security monitoring operations.

Study Limitations and Practical Implications

Despite the significant results obtained, this study presents some limitations that should be considered. Firstly, the database used has a relatively small size, with 9,357 records, and a more balanced class distribution than real cybersecurity scenarios. In production environments, attacks are rare events, and this difference may overestimate the models’ performance. Furthermore, the analyzed data are derived from simulated or controlled logs, which may not fully reflect the complexity and variability of real attacks, especially adaptive or zero-day attacks, which are unprecedented and difficult-to-predict intrusions.

Another limitation refers to the absence of external validation with independent databases, which restricts the generalization of the results to other contexts. External validation is crucial to confirm the robustness and applicability of the model in different operational scenarios. Finally, real-time deployment aspects such as latency, computational cost, and integration with existing monitoring systems were not explored. These are critical factors for practical application in corporate environments, and their absence prevents a complete evaluation of the model’s operational viability in a production environment.

Comparison with Literature

The results obtained in this research demonstrate that the developed model has reached a level of excellence comparable to the main benchmarks in the scientific literature on information security. The Gradient Boosting model, by achieving an accuracy of 0.887 on the test set, presents a statistical performance similar to consolidated studies that use, for example, the KDD’99 database, whose intrusion detection hit rates routinely stand around 89% (Stolfo, 2000). This convergence with the results from scientific literature confirms that the integration between behavioral signal analysis and ensemble algorithms constitutes a highly effective strategy for anomaly detection in virtual environments.

It is relevant to emphasize that, while many academic works are based on historical databases, this study applied machine learning algorithms to a set of modern behavioral logs. Achieving high metrics, such as an ROC-AUC of 0.878 and an F1-Score of 0.884, on data reflecting contemporary traffic patterns, validates the classifier’s robustness for applications in real-world scenarios. The analysis of behavioral signals, such as login failures and IP reputation, combined with the ensemble algorithms’ ability to process non-linear interactions, offers a promising approach for intrusion detection, aligning with current cybersecurity needs (Alsheri, 2023; Shewale and Deshpande, 2021; Souza and Arima, 2024).

In summary, the research results demonstrate that the application of Machine Learning tools, particularly Gradient Boosting, is a highly effective strategy for detecting cyberattacks based on user habit events. The final model presented a high level of assertiveness and a robust discriminatory capacity between legitimate traffic and intrusion attempts, validating its applicability for real-time security monitoring. The integration of behavioral signals with ensemble algorithms has proven to be a promising approach for building more resilient defense layers against stealthy evasion tactics in the contemporary cybersecurity landscape.

4. Conclusion

The present study sought to develop and validate high-performance Machine Learning models for the assertive detection of cyberattacks, focusing on the analysis of behavioral patterns and digital habits of users on websites. It was verified that behavioral variables, such as login failures and access attempts, along with IP address reputation and browser type, presented robust statistical significance for discriminating between legitimate and malicious traffic. After data treatment and normalization, classification algorithms were trained and evaluated. The Gradient Boosting model consolidated itself as the most effective, achieving an accuracy of 0.887 and a ROC-AUC of 0.878 on the test set. This classifier demonstrated an ideal balance between precision and sensitivity, correctly identifying 640 attack instances and minimizing two false positives. The main contribution lies in the validation that the integration of behavioral signals with ensemble algorithms constitutes a highly effective strategy for anomaly detection in virtual environments, offering robust generalization capability and stability for real-time security monitoring.

However, the study has limitations, such as the relatively small size of the database and its simulated or controlled nature, which may not capture the complexity of zero-day attacks. The absence of external validation with independent databases restricts the generalization of the results, and aspects of real-time deployment, such as latency and computational cost, were not explored. For future studies, it is recommended to perform a cutoff analysis to optimize the probability threshold for classification, aiming to further refine the model’s performance. It is also suggested to evaluate the impact of this adjustment on reducing false negatives in communication protocols with a higher incidence of malicious traffic, such as TCP, in order to enhance the system’s resilience against evasion tactics.

Bibliographic References

ALSHEHRI, A. Cyberattack detection framework using machine learning and user behavior analytics. Computer Systems Science and Engineering, v. 44, n. 2, p. 1679-1689, 2023.

INTERNATIONAL BUSINESS MACHINES [IBM]. Relatório do custo das violações de dados 2025. Disponível em: https://www.ibm.com/br-pt/reports/data-breach. Acesso em: 22 set. 2025.

LINS, B. F. E. A evolução da Internet: uma perspectiva histórica. Cadernos Aslegis, n. 48, p. 11-46, 2013. Disponível em: https://www.aslegis.org.br/todas-as-edicoes-artigos/106-caderno-aslegis-48. Acesso em: 13 out. 2025.

MENDONÇA, C. M. C.; ANDRADE, A. M. V.; SOUSA NETO, M. V. Uso da IoT, Big Data e Inteligência Artificial nas capacidades dinâmicas. Revista Pensamento Contemporâneo em Administração, v. 12, n. 1, p. 131-151, 2018.

MIRANDA, J. C. A World Wide Web como uma tecnologia de propósitos gerais. Revista Multiface Online, v. 11, n. 1, p. 25-42, 2024. Disponível em: https://revistas.face.ufmg.br/index.php/multiface/article/view/8625. Acesso em: 08 out. 2025.

SHEWALE, S.; DESHPANDE, L. Analytical study on IP reputation services & automation for traditional method. International Journal of Advanced Research in Computer and Communication Engineering, v. 10, n. 5, p. 114-117, 2021.

SOUZA, C. H. M.; ARIMA, C. H. Avaliação de algoritmos de machine learning para detecção de malware IoT no dataset IoT-23. Anais do Simpósio Brasileiro de Cibersegurança, p. 767-772, 2024.

SPEROTTO, A. An overview of IP flow-based intrusion detection. IEEE Communications Surveys & Tutorials, v. 12, n. 3, p. 343-356, 2010.

STOLFO, S. J. Cost-based modeling and evaluation for data mining with application to intrusion detection: results from the MIT Lincoln Labs classification evaluation. New York: Columbia University, 2000.

Article originating from the Final Course Project of the Specialization in Data Science and Analytics of the MBA USP/Esalq

To learn more about the course, click here and access the MBX Academy platform