Hybrid method for anomaly detection in logical clusters of cyber vulnerabilities using an ensemble of machine learning models

Abstract

The article presents the hybrid anomaly detection method based on logical clustering of vulnerabilities and the application of machine learning techniques. The dataset includes information about software vulnerabilities, including CVSS metrics, severity levels, CWE types, temporal characteristics, and assignment to logical groups formed based on the OWASP Top Ten.
At the first stage, data analysis is performed along with the construction of additional temporal features. Subsequently, logical clustering of vulnerabilities is carried out, allowing the data to be partitioned into semantically homogeneous groups such as Broken Access Control, Injection, Cryptography & Data Protection, Configuration & Design Weaknesses, Authentication and Mishandling Failures, and Software Failures. This approach reduces data heterogeneity and improves the quality of subsequent analysis.
At the second stage, the Isolation Forest anomaly detection method is applied to identify atypical vulnerabilities within each cluster. The obtained results are used as pseudo-labels for training ensemble machine learning models, including Decision Tree, Random Forest, and Gradient Boosting. These models are employed for anomaly classification and for evaluating their predictability based on a feature space that includes CVSS metrics, exploitability score, impact score, and temporal characteristics.
Model performance is evaluated using Accuracy, Precision, Recall, F1-score, and Log Loss metrics. Experimental results show that Gradient Boosting demonstrates the best performance on large datasets, while Random Forest provides more stable results on smaller clusters. Decision Tree offers high interpretability but is prone to overfitting and exhibits weaker generalization capability compared to other models.
The proposed hybrid method improves anomaly detection accuracy through the use of semantically homogeneous clusters and an ensemble of models.
The results of the study can be applied in information security monitoring and incident management systems, as well as in the development of intelligent forecasting systems aimed at detecting anomalous events and modeling the dynamics of vulnerability propagation.