Claim Missing Document
Check
Articles

Found 1 Documents
Search
Journal : journal of computer science application and engineering

Cybersecurity Threat Detection in IT Infrastructure Using an XGBoost-Based Model Temitayo Afolen; Amariel Nkemdilim
Journal of Computer Science Application and Engineering (JOSAPEN) Vol. 4 No. 2 (2026): JOSAPEN - July
Publisher : Lentera Ilmu Publisher

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.70356/josapen.v4i2.136

Abstract

The increasing complexity of IT infrastructure has created significant challenges in detecting cybersecurity threats, particularly malicious network activities that can evade conventional security mechanisms. This study proposes an XGBoost-based machine learning model for detecting cybersecurity threats in network traffic. A controlled cybersecurity simulation environment was used to generate 50,000 network-flow observations representing benign activities, including web browsing, DNS requests, file transfer, and client-server communication, as well as malicious activities involving DoS, DDoS, port scanning, and brute-force attacks. After preprocessing, 48,000 observations were retained and divided into 80% training and 20% testing datasets using stratified sampling. XGBoost feature importance and randomized hyperparameter optimization with five-fold cross-validation were applied to improve model performance. The optimized XGBoost model achieved 98.30% accuracy, 98.10% precision, 97.90% recall, 98.00% F1-score, and 99.20% ROC-AUC, with a reported false-positive rate of 1.20%. XGBoost also outperformed Logistic Regression, Decision Tree, Random Forest, and SVM. SHAP analysis identified Flow Packets/s, Flow Bytes/s, Flow Duration, and packet-related characteristics as influential features. These findings demonstrate the potential of XGBoost as an accurate and explainable approach for cybersecurity threat detection in IT infrastructure.