Machine learning model for classifying the severity level of cyber security attacks

Imam Riadi (Universitas Ahmad Dahlan)
Sri Winiarti (Informatics Department, Universitas Ahmad Dahlan)
Herman Yuliansyah (Informatics Department, Universitas Ahmad Dahlan)
Muhammad ‘Arif Bin Mohamad (Universiti Malaysia Pahang Al-Sultan Abdullah)

International Journal of Advances in Intelligent Informatics
Vol 12, No 2 (2026): May 2026

Cyberattacks are becoming increasingly sophisticated, necessitating defense mechanisms that go beyond simple detection to include severity assessment for prioritizing mitigation. This study proposes a comprehensive machine learning framework to classify cyberattack severity levels (Low, Medium, High) using a modern, high-dimensional dataset. Addressing the critical challenge of class imbalance, the research integrates the Synthetic Minority Oversampling Technique (SMOTE) with a rigorous feature selection process involving SelectKBest. Four algorithms Naive Bayes, K-Nearest Neighbor (KNN), Random Forest (RF), and Support Vector Machine (SVM) were evaluated using 10-fold cross-validation. The results demonstrate that the SVM model with an RBF kernel achieves superior performance with an accuracy of 97.30% and a False Negative Rate (FNR) of only 3.1% for high-severity threats. This research contributes a robust, data-driven approach to severity classification that effectively handles feature non-linearity and class imbalance, offering actionable insights for real-time security operations.