Anomaly Detection and Security Enhancement Through Machine Learning in Administrative Information Systems

The task of identifying anomalies in cybersecurity presents notable difficulties, frequently marked by substantial computational intricacy or dependence on heuristic approaches. This study presents a novel two-tier classification model that incorporates many machine learning approaches, such as Naïve Bayes, Random Forest, Decision Tree, Certainty Factor Voting version of KNN classifiers, and Linear Discriminant Analysis for dimension reduction. The experimental data reveal a considerable and promising improvement in detection rates and false alarms compared to previous models. The model is trained by utilizing two balanced training sets that are constructed using the SMOTE method. The evaluation of the chosen similarity measure is conducted to effectively handle imbalanced network anomaly datasets. The suggested model demonstrates a notable characteristic of having a low calculation time, which may be attributed to its effective dimension reduction and feature selection techniques. The system demonstrates exceptional proficiency in identifying uncommon and intricate forms of attacks, including those that closely resemble typical patterns of activity, such as User to Root and Remote to Local, which present elevated levels of risk. The evaluation procedures are carried out utilizing the Numenta Anomaly Benchmark (NAB) dataset, which offers a thorough evaluation of the effectiveness of the model in real-world situations.