A classifier assigns observations to predefined classes using their attributes. In cybersecurity, it can label network traffic as safe or suspicious, or articles as high or low risk. section 12.3.1 section 12.4.1
Common classification workflows connect data preparation, model training, and evaluation:
- For network traffic, prepare features and labels, split data into training and testing sets, train random forest and SVM models, then predict and measure accuracy. section 12.3.1
- For cybersecurity articles, extract text features with TF-IDF and classify risk using logistic regression; inspect precision, recall, F1-score, accuracy, and a confusion matrix. section 12.4.1
Compare results in context
In a network-traffic exercise, random forest reached 1.00 accuracy while SVM reached about 0.87. An article-classification report showed 0.67 accuracy on six test examples. These results describe those test sets, not a guarantee of performance on new traffic or articles. section 12.3.1 section 12.4.1
Listing 12.2 Using random forest and SVM to detect threats
import numpy as np #1
import pandas as pd #2
from sklearn.model_selection import train_test_split #3
from sklearn.ensemble import RandomForestClassifier #4
from sklearn.svm import SVC #5
from sklearn.metrics import accuracy_score,
classification_report #6
# Create a synthetic dataset for login activity (malicious vs. normal)
np.random.seed(42) #7
n_samples = 100 #8
# Generate features: login hour and failed login attempts
login_hours = np.random.randint(0, 24, n_samples) #9
failed_attempts = np.random.randint(0, 10, n_samples) #10
# Generate labels: 1 for malicious activity, 0 for normal activity
labels = np.array([1 if (hour > 20 or attempts > 5)
else 0 for hour, attempts in
zip(login_hours, failed_attempts)]) #11
# Create a DataFrame for visualization and model training
df = pd.DataFrame({
'Login_Hour': login_hours,
'Failed_Attempts': failed_attempts,
'Label': labels
}) #12
# Split the dataset into training and testing sets
X = df[['Login_Hour', 'Failed_Attempts']] #13
y = df['Label'] #14
X_train, X_test, y_train, y_test = train_test_split(
X, y, test_size=0.3, random_state=42) #15
# Train a Random Forest model
rf_model = RandomForestClassifier(random_state=42) #16
rf_model.fit(X_train, y_train) #17
# Train an SVM model
svm_model = SVC(kernel='linear', random_state=42) #18
svm_model.fit(X_train, y_train) #19
# Make predictions
rf_predictions = rf_model.predict(X_test) #20
svm_predictions = svm_model.predict(X_test) #21
# Evaluate the models
rf_accuracy = accuracy_score(y_test, rf_predictions) #22
svm_accuracy = accuracy_score(y_test, svm_predictions) #23
# Display results
print("Random Forest Accuracy:", rf_accuracy) #24
print("SVM Accuracy:", svm_accuracy)#25
print("\nRandom Forest Classification Report:\n",
classification_report(y_test, rf_predictions)) #26
print("\nSVM Classification Report:\n",
classification_report(y_test, svm_predictions))
Inspect the example Python workflow for classifying login activity with random forest and SVM. section 12.3.1
