20.500.12556/DKUM-92909 Uporaba metod strojnega učenja za zaznavanje kompleksnejših kibernetskih groženj Machine learning-based detection of complex cyber threats Zaradi porasta in kompleksnosti kibernetskih groženj postajajo tradicionalni pristopi k zaznavanju napadov manj učinkoviti. Algoritmi strojnega učenja z zmožnostjo hitre obdelave velike količine podatkov ponujajo napredne rešitve za zaznavanje in preprečevanje vedno bolj prikritih in kompleksnih groženj. Namen magistrskega dela je bil ugotoviti, katere metode strojnega učenja so najučinkovitejše pri zaznavi napadov izvidništva in naprednih trajnih groženj – kompleksnejših vrst kibernetskih napadov. Raziskali smo, kako ustrezna predpriprava podatkov vpliva na učinkovitost napovedi in koliko je ansambelski pristop pri tem učinkovitejši. S sistematičnim pregledom literature smo ugotovili, da so pri zaznavi kompleksnih groženj najučinkovitejši algoritmi XGBoost, LightGBM, odločitvena drevesa, naključni gozd in naivni Bayesov klasifikator. Omenjene algoritme smo vključili v eksperiment, v katerem smo metode s pomočjo metrik (točnost, natančnost, priklic in F1 vrednost) ovrednotili. Ugotovili smo, da je pri klasifikaciji napadov najučinkovitejši algoritem naključni gozd. Iste algoritme smo vključili tudi v ansambel, pri čemer smo ugotovili, da je pri zaznavi naprednih trajnih groženj in izvidništva ansambelski pristop učinkovitejši, saj dosega višje rezultate vseh štirih metrik. Z ustreznimi tehnikami predpriprave podatkov pa smo dokazali, da ta pomembno vpliva na končno učinkovitost modelov oz. ansambla. As the number and complexity of cyber threats grow at an increasing pace, traditional approaches to attack detection are becoming less effective. Machine learning algorithms, with their ability to quickly process vast amounts of data, offer advanced solutions for detecting and preventing increasingly covert and complex threats. The aim of this master's thesis was to determine which machine learning methods are most effective in detecting reconnaissance attacks and advanced persistent threats – more complex types of cyberattacks. We examined how proper data preprocessing impacts prediction effectiveness and to what extent ensemble methods improve accuracy. Through a systematic literature review, we found that the most effective algorithms for detecting complex threats are XGBoost, LightGBM, decision trees, random forest, and the naive Bayes classifier. We included these algorithms in our own experiment, where we evaluated the methods using metrics such as accuracy, precision, recall, and F1 score, and found that the most effective algorithm for classifying attacks was random forest. We also incorporated these algorithms into an ensemble, where we discovered that, for detecting advanced persistent threats and reconnaissance, the ensemble approach is more effective than individual methods, achieving higher scores across all four metrics. Furthermore, we demonstrated that proper data preprocessing significantly impacts the final performance or the models or ensemble. kibernetska varnost napredne trajne grožnje izvidništvo strojno učenje cybersecurity advanced persistent threats reconnaissance machine learning true true false [M. Rotovnik] Slovenski jezik Angleški jezik Magistrsko delo/naloga 2025-05-25 19:48:56 2025-07-08 10:13:52 2025-07-28 13:02:16 0000-00-00 00:00:00 2025 0 Maribor 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 004.85:004.056.5(043.2) 244041475 MAG_Rotovnik_Maja_2025.pdf MAG_Rotovnik_Maja_2025.pdf 1 93AD3AE1BEA708BA61A7CB648348CDEB b0393033c1656f9b121fbc25f5a784fbc8b5c986f574be8ea498fc1723000339 f097568e-3990-11f0-8f9d-00155d000105 https://dk.um.si/Dokument.php?lang=slv&id=191242 Fakulteta za elektrotehniko, računalništvo in informatiko 0 0 0