Confusion Matrix Explainability to Improve Model Performance: Application to Network Intrusion Detection

High-performance Machine Learning (ML) models are indispensable in cybersecurity due to the need for real-time threat detection, scalability in handling large datasets, and the ability to recognize complex patterns and evolving threats. These models should reduce false positives and negatives, adapt to dynamic environments, and enable automated response mechanisms. This paper introduces an innovative methodology aimed at improving the performance and interpretability of ML models in binary classification, with a distinct emphasis on network intrusion detection. The proposed approach centers on an in-depth analysis of the confusion matrix, utilizing its insights to enhance model performance. We test our methodology on the UNSW-NB15 network intrusion dataset. We managed to improve almost all metrics with an increase in accuracy from 81.92% to 89.6%, recall from 76.42% to 89.22%, and F1 score from 82.51% to 89.76%, with the potential to obtain more improvements.