Analysis and Comparison of Machine Learning Algorithms for Detecting Zero-Day Threats in Network Systems

Abstract

This research focuses on analyzing and comparing Machine Learning algorithms for detecting Zero-Day threats in network systems. The objectives include: 1) studying the capability of Machine Learning algorithms to detect Zero-Day attacks, 2) analyzing the performance of these algorithms in differentiating and classifying behaviors indicative of Zero-Day attacks, and 3) proposing practical approaches for integrating analytical results into network security systems to counteract Zero-Day threats. Data utilized in this study were collected from Threat Intelligence and actual network defense systems.

The findings reveal that Neural Networks (NN) achieved an accuracy of 95.2% with a False Positive Rate (FPR) of just 2.5%, demonstrating superior performance in learning new data and accurately responding to Zero-Day threats. This capability significantly reduces the burden of handling false alarms and enhances network protection. Random Forest (RF) and Support Vector Machine (SVM) achieved accuracies of 90.5% and 88.7%, respectively, but were less effective than NN in minimizing FPR. Additionally, the use of Anomaly Detection and Ensemble Models further strengthened the ability to detect complex threats and adapt to dynamic environments. The developed system effectively blocks repeated attack IPs and promptly detects anomalous        behavior, offering advanced protection against emerging threats that traditional systems cannot address. This research provides practical recommendations for developing network security systems with enhanced precision, flexibility, and resilience to sophisticated and evolving threats. Moreover, it highlights the crucial role of Machine Learning technologies in bolstering cybersecurity, serving as an essential tool for preventing and managing threats in the digital age.