<![CDATA[The increasing complexity of IT infrastructure has created significant challenges in detecting cybersecurity threats, particularly malicious network activities that can evade conventional security mechanisms. This study proposes an XGBoost-based machine learning model for detecting cybersecurity threats in network traffic. A controlled cybersecurity simulation environment was used to generate 50,000 network-flow observations representing benign activities, including web browsing, DNS requests, file transfer, and client-server communication, as well as malicious activities involving DoS, DDoS, port scanning, and brute-force attacks. After preprocessing, 48,000 observations were retained and divided into 80% training and 20% testing datasets using stratified sampling. XGBoost feature importance and randomized hyperparameter optimization with five-fold cross-validation were applied to improve model performance. The optimized XGBoost model achieved 98.30% accuracy, 98.10% precision, 97.90% recall, 98.00% F1-score, and 99.20% ROC-AUC, with a reported false-positive rate of 1.20%. XGBoost also outperformed Logistic Regression, Decision Tree, Random Forest, and SVM. SHAP analysis identified Flow Packets/s, Flow Bytes/s, Flow Duration, and packet-related characteristics as influential features. These findings demonstrate the potential of XGBoost as an accurate and explainable approach for cybersecurity threat detection in IT infrastructure.]]>
Copyrights © 2026
