Comparative Analysis of Classification Methods for Cyberattack Detection on Computer Networks

Abstract

The rapid growth of computer networks has increased the complexity and intensity of cyber threats, making machine learning based intrusion detection one of the most widely studied defense mechanisms. This study compares the performance of five classification methods Decision Tree, Random Forest, Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Naive Bayes in detecting five categories of network activity: Normal, Denial of Service (DoS), Probing, Remote to Local (R2L), and User to Root (U2R). Due to limited access to sensitive real-world network traffic data, this study uses a small-scale simulated dataset of 500 samples generated programmatically using controlled statistical distributions to represent the characteristics of each category, including the class imbalance condition commonly found in real network traffic. The data was split into 70% training and 30% testing using a stratified scheme and evaluated using accuracy, precision, recall, F1-score, and computation time metrics. Results show that Decision Tree achieved the highest macro F1-score (85.96%) with 94.00% accuracy, slightly ahead of Naive Bayes (84.52% macro F1-score, 95.33% accuracy). Random Forest recorded the highest overall accuracy (96.67%), but its macro F1-score (84.06%) lagged due to low recall on the U2R class, which has very few samples. Feature-importance analysis indicates that srv_count, dst_host_count, and count are the main determinants for distinguishing attack categories. Naive Bayes and KNN recorded the fastest computation times, while Random Forest required the longest training time. The small dataset size causes performance estimates on minority classes (R2L and U2R) to be prone to fluctuation, so these findings should be regarded as a preliminary proof-of-concept study requiring further validation using a larger dataset or real world network traffic data.