Analisis Komparatif Random Forest dan Support Vector Machine untuk Klasifikasi Tingkat Keparahan Serangan Siber - Islamey, Reyhanssan; Winiarti, Sri; Riadi, Imam (Universitas Negeri Gorontalo, 2026)
The escalating volume and sophistication of cyberattacks on network infrastructures processing massive daily traffic have overwhelmed security teams in prioritizing incident responses rapidly and accurately, a phenomenon known as alert fatigue. This study aims to analyze and compare the performance of the Support Vector Machine (SVM) and Random Forest (RF) algorithms for classifying cyberattack severity levels (Low, Medium, and High). The study uses the public Cyber Security Attacks dataset, consisting of 40,000 network traffic records reduced to 20,000 clean entries through preprocessing and feature engineering. The methodology includes data cleaning, selecting 10 significant features using SelectKBest, standardizing numerical features, and evaluating models across three data split scenarios (70:30, 80:20, and 90:10) using a stratified splitting approach. Experimental results show that SVM consistently outperforms RF across all scenarios, with the best performance in the 80:20 split, achieving 98.92% accuracy and a weighted average F1-Score of 0.99 using hyperparameter configurations of C = 100 and gamma = 0.01. The superiority of SVM lies in its ability to model non-linear relationships and complex feature interactions in data with overlapping class boundaries. In contrast, RF exhibits an over-prediction bias toward the minority class (’Low’) due to the class_weight=’balanced’ mechanism and limitations of axis-based separation. These findings confirm that SVM with a Radial Basis Function (RBF) kernel is more suitable for cyberattack severity classification, particularly in automated incident detection systems requiring balanced precision and recall as well as reliable decision-making.