Machine Learning for Intrusion Detection: Benchmarking 6 Algorithms on Network Auth Logs

Moving Beyond Static Heuristics

Static threshold intrusion detection systems struggle when sophisticated attackers conduct 'low-and-slow' brute-force attacks—spacing authentication attempts across several minutes to bypass rule windows.

Machine learning classifiers can detect behavioral nuances by evaluating multivariate feature vectors rather than single scalar counters.

The Class Imbalance Challenge

In real-world network authentication logs, legitimate logins typically account for 98-99% of total entries, while attack sequences represent a tiny minority. Training standard supervised models on raw datasets leads to high accuracy paradoxes where models simply predict 'Normal' and achieve 99% accuracy while missing 100% of intrusions.

To resolve this, our methodology incorporated: 1. **StandardScaler:** Normalizing numeric distributions across feature sets. 2. **SMOTE (Synthetic Minority Over-sampling Technique):** Synthesizing realistic minority class vectors in feature space.

Comparative Algorithm Performance

We evaluated six supervised learning algorithms across Precision, Recall, and F1-Score:

| Algorithm | Precision | Recall | F1-Score | Inference Latency |
|---|---|---|---|---|
| **Random Forest** | 99.1% | 98.4% | **98.7%** | 8.2 ms |
| **Decision Tree** | 97.8% | 97.5% | 97.6% | **2.1 ms** |
| **SVM (RBF Kernel)** | 96.4% | 94.2% | 95.3% | 24.5 ms |
| **KNN (k=5)** | 95.1% | 93.8% | 94.4% | 31.0 ms |
| **Logistic Regression** | 89.2% | 88.0% | 88.6% | 1.8 ms |
| **Gaussian Naive Bayes**| 84.5% | 89.1% | 86.7% | 3.2 ms |

**Takeaway:** Random Forest demonstrated the highest overall detection robustness against varied brute-force distributions, while single Decision Trees provided an ultra-lightweight alternative suitable for low-power edge gateways.