MACHINE LEARNING DRIVEN NETWORK TRAFFIC ANALYSIS FOR CYBERSECURITY: A COMPARATIVE STUDY OF SUPERVISED AND UNSUPERVISED LEARNING APPROACHES

Abstract

This study looks at how well machine learning (ML) methods work in cybersecurity, focusing on their ability to tell apart malicious and normal network traffic. Using the CICIDS2017 dataset, we compare supervised learning models like Random Forest and Support Vector Machines with unsupervised techniques such as K-means clustering and Isolation Forest. We evaluate their performance using multiple metrics, including accuracy, precision, recall, F1-score, and cluster validity indices, to find the most effective approach for spotting anomalies in network data. The results show that Random Forest delivers the best overall performance, achieving over 99.4% accuracy with very few false negatives. Meanwhile, unsupervised methods excel at detecting new, previously unseen patterns without needing labeled data. In particular, the Isolation Forest model achieves a recall of 93%, making it highly effective at identifying anomalies. K-means clustering also performs well, clearly separating traffic patterns with strong Silhouette scores (0.8622) and favorable Davies-Bouldin indices (0.6063).