Detection of sybil bots using machine learning techniques

This study aims to comparatively evaluate the performance of various machine learning algorithms for network-based anomaly detection using the NSL-KDD dataset. NSL-KDD, which categorizes attack types into four main groups (DoS, Probe, R2L, U2R), has been considered a suitable dataset for supervised learning methods due to its labeled and balanced structure. Within the scope of the study, initial statistical analyses and exploratory data analysis were conducted on the dataset, followed by data preprocessing steps. In this process, categorical variables were converted into numerical format, missing values were removed, and the minority classes were balanced using the SMOTE technique. For feature selection, the Mutual Information (MI) method was applied to determine the 15 most informative variables, and models were trained using these features. Subsequently, the models were retrained using all available features, and the results were compared. During the modeling phase, Logistic Regression, Naive Bayes, Random Forest, K-Nearest Neighbors (KNN), Support Vector Machines (SVM), AdaBoost, and Artificial Neural Network (ANN) algorithms were employed. Hyperparameter optimization was performed for each model using GridSearchCV or RandomizedSearchCV. Model performances were evaluated based on several metrics, including accuracy, precision, recall, and F1-score. The results indicate that some models achieved high accuracy particularly for dominant classes such as DoS, while performance dropped significantly for underrepresented classes like R2L and U2R. These findings emphasize the importance of careful algorithm selection when dealing with imbalanced datasets.