Machine Learning Boosted Trees Algorithms in Cybersecurity: A Comprehensive Review

In the ever-evolving landscape of cybersecurity, the integration of machine learning algorithms has become imperative to effectively detect and prevent cyber-attacks. This paper presents a comprehensive comparative study of three powerful boosted tree algorithms: XGBoost, CatBoost, and LightGBM, for network intrusion detection using the CICIDS2017 dataset, pre-processing the data to ensure its reliability, and utilizing the Chi-squared approach for feature selection. Detection model evaluation is performed using precision, recall, and F1-score, shedding light on the performance of each algorithm. Addressing challenges such as explainability and imbalanced data, we explore how these algorithms can enhance the security of digital systems. The literature review highlights the growing interest in the application of boosted trees in cybersecurity. Previous research has showcased the promising results of these algorithms in detecting and mitigating various cyber threats, making them valuable tools for fortifying digital security. XGBoost emerges as the most suitable choice, offering competitive accuracy while being faster in both training and prediction compared to the other algorithms. Additionally, SHAP values help identify key features influencing XGBoost’s predictions, with “Destination Port,” “Init Win bytes backward,” and “Init Win bytes forward” standing out as crucial contributors. The insights gained from this research can aid in developing more robust and transparent intrusion detection systems, by leveraging the power of machine learning algorithms, thus contributing to ongoing efforts in fortifying digital security against a constantly evolving threat landscape.