This work aimed to develop a trained machine-learning model that automatically detects and blocks dangerous requests in cybersecurity systems. The main classification algorithms were analyzed during the study, such as logistic regression, support vector machine, decision trees, and deep neural networks. For each algorithm, models were trained using a set of network traffic data, which allowed us to automate the process of classifying and detecting dangerous requests in real-time. The models were trained in Matlab based on the Network Traffic Dataset. The study's main results were a comparison of the effectiveness of different algorithms using metrics such as accuracy, F-score, precision, and recall. In particular, the decision tree-based model demonstrated the highest level of accuracy, which ensured the effective detection of known and new types of attacks. In addition, methods of blocking dangerous queries are considered. The supervised learning method accurately detects known threats but requires significant computing resources. Signature-based methods have shown effectiveness in detecting known attacks, but they are unable to detect new, unknown threats. Behavioral analysis and anomaly detection are good at detecting new attacks but can be circumvented by encryption or polyforms. The blacklist and whitelist methods are easy to implement but require regular updates of the lists and are not always effective against new threats. In general, the results obtained confirm the high efficiency of the proposed methods and models in real conditions and the possibility of their integration into modern cybersecurity systems to automate the protection process.
Modern cybersecurity threats require the use of effective methods to detect and block dangerous requests automatically. Machine learning (ML) plays a key role in this process, allowing the creation of automated classifiers to analyze traffic and identify potentially malicious activities. The main classification algorithms include logistic regression (LR), which estimates the probability of a query belonging to a certain class; support vector machine (SVM), which finds the optimal hyperplane for class separation; decision trees (DT), which builds a hierarchical decision-making structure based on rules; and deep neural networks (DNN), which can handle complex dependencies in large amounts of data. However, the effective application of these algorithms requires their software implementation, in particular, the creation of an automated classification model that will accurately identify dangerous queries in real time. In addition, it is important to analyze and improve existing methods of blocking dangerous requests to increase the effectiveness of cyber defense by combining ML approaches with traditional methods.
The goal of this work is to develop a trained model using ML algorithms, which was not implemented in the reviewed works. The tasks were to analyze classification algorithms and develop their architectures, train an automated classification model based on these algorithms, and analyze existing methods for blocking dangerous queries .
For a better understanding, similar works should be considered. For example, V. Gnatyuk et al. [
On the other hand, A. González Álvarez et al. conducted a study of the impact of optimization
on the performance of pre-trained ML models for image classification [
In his turn, A. Vrincean [
The study examined the main classification algorithms used to detect and block dangerous requests
automatically in cybersecurity systems. LR, SVM, DT, and DNN are analyzed. For each algorithm, a
general description and examples of use in the field of cybersecurity are presented [
We used Matlab and the Network Traffic Dataset obtained in comma-separated values (CSV)
format to implement the automated query classification from the Kaggle platform [
In addition, the study used methods of blocking dangerous queries [
C ´ = arg max confidence( C i , x)
Ci∈ C (1) where C´ is the optimal classifier selected to process the query; C = {C1, C2, ..., Cn} is the set of available classifiers;Ci is a separate classifier from the set ;x is the input query to be classified; confidence(Ci, x) is the confidence function in the classifierCi for the query , which evaluates how well this classifier is the best for the current query.
For signature blocking, we used query verification against a set of known attacks, which is
formalized by [
S ( x )= { 1 , if x ∈ S
0 , else D = | xnew− μ|
σ B ( x )= { 1 , if x ∈ W 0 , if x ∈ B where x is an input request; S is a set of known attack signatures.
In turn, the method of behavioral analysis and anomalous detection was based on an assessment
of the deviation of a new request from the average value of the profile, which is determined by [
As information technology advances, the number of cyberattacks aimed at unauthorized access to confidential data is growing. Information protection is becoming one of the key challenges for cybersecurity systems, requiring the use of innovative approaches to detecting and neutralizing threats. One of the most promising areas is the use of ML methods and algorithms that automate the process of classifying and blocking dangerous requests. In cybersecurity, this helps to improve the accuracy of detecting potential attacks, minimize the risk of false blocking, and adapt algorithms to new types of threats. In this context, developing an effective ML-trained model for analyzing queries and determining their danger is a pressing task that significantly impacts improving information systems’ protection level. Choosing an optimal ML classifier to implement an automated mechanism for blocking dangerous queries is important. Modern classification algorithms, such as LR, SVM, DT, and DNN, have different characteristics that affect the performance of a cybersecurity system (Table 1). LR is one of the basic ML algorithms used for binary classification. Due to its mathematical simplicity and effectiveness in cases where the data has linearly separated classes, LR allows you to quickly identify potentially malicious queries and take measures to block them.
An algorithm for binary classification that predicts the probability of an object belonging to a certain category based on independent variables.
A classification method that uses hyperplanes to divide data into classes, capable of working with linearly and nonlinearly separated data.
An algorithm that builds a decision tree for classification, where each node is a certain feature, and the branches are possible values.
A network of neurons with many layers that can learn complex, non-linear patterns in data.
anomalies in large semantic data sets, such as real-time threat analysis.
The main limitation of LR is its poor ability to handle complex non-linear dependencies between features. However, its use is justified in cases where it is necessary to quickly assess the risk of threats based on key request parameters, such as the source IP address, HTTP request structure, frequency of requests, etc. For a better understanding, consider the process of classifying requests using LR in a cybersecurity system (Figure 1).
The provided scheme starts by processing input data, such as query parameters or user behavior. This data is passed to the model to calculate the probability that the request is malicious or normal. The result is a threat probability that is compared to a predefined threshold. If the calculated probability exceeds this threshold, the request is classified as malicious and is subject to blocking. This model allows you to quickly and accurately detect suspicious requests, reducing the risk of cyberattacks.
On the other hand, SVM algorithm is a powerful classification method that uses hyperplanes to divide data into classes. The advantage of SVM is the ability to efficiently process both linearly and nonlinearly separated data. SVM also has the ability to adapt to changes in the types of attacks and queries, which makes it a reliable tool for protecting information systems from new threats. In the process of classification using SVM, an optimal hyperplane is first constructed to maximize the distance between classes. This allows you to separate malicious queries from normal ones effectively. After that, the query is compared with this hyperplane to determine its class. It is worth considering the classification of queries using the SVM algorithm (Figure 2).
First, the input query with extracted features goes through a preprocessing stage, where the data is normalized and, if necessary, PCA is applied. Next, a hyperplane is constructed to maximize the distance between classes, allowing for a clear query distribution. After that, the query is compared to the hyperplane, and based on this comparison, it is determined whether the query is malicious (attack) or normal. If a malicious request is detected, it is blocked, while a normal request is allowed to be processed further. In turn, the DT algorithm works on the principle of sequentially dividing data into subgroups depending on the values of certain characteristics. This makes it possible to clearly distinguish between normal and malicious queries using a hierarchical decisionmaking structure. The main advantage of DT is its interpretability, which makes it easy to track the logic of classification and threat identification. The disadvantage may be the tendency to overlearn, especially if the tree becomes too deep. For a more detailed analysis, consider the classification of requests using DT (Figure 3).
The first step is to receive an HTTP request and extract key characteristics from it. If the address is known and safe, the risk level is checked. If the URL is suspicious, the request can be blocked. Finally, if all checks are successful, the request is allowed, otherwise it is blocked. In addition, DNNs can also efficiently analyze large data sets and detect complex, non-linear patterns.
Due to its multi-layered architecture, it can accurately classify cybersecurity requests, adapt to new threats, and minimize false blocking. One of the key advantages of DNNs is the ability to automatically extract features, which allows you to find hidden correlations in the input data. This algorithm can detect complex attacks that are difficult to identify using traditional methods. However, DNN requires significant computing resources and may have problems with the interpretability of solutions, which is an important aspect of cybersecurity systems. To understand how query classification works using DNNs, we should analyze this process (Figure 4).
The system receives a request to be verified. After that, the key characteristics of the request are extracted, such as the IP address, URL structure, HTTP headers, request content, etc. Next, the data is normalized and converted into a format suitable for neural network processing. A multilayer model processes data by passing through several hidden layers that are trained on a large sample. DNN determines the probability of a request belonging to a certain class: “malicious” or “normal”. A request is blocked if it is identified as dangerous; if not, it is passed on for further processing.
For the practical implementation of automated query classification, it is necessary to implement an
effective mechanism for training the ML model. For this purpose, we propose to use the Matlab tool
and the Network Traffic Dataset [
The next step is to generate random class labels for classification (normal traffic or attack). After that, the data is divided into training (80%) and test (20%) samples using cvpartition. Finally, the tables are converted into arrays, where X_train and X_test contain the features, and Y_train and Y_test contain the corresponding class labels After data preprocessing, the next step is to train the ML model (Figure 6). Since the amount of data is significant (315309 rows), a subset of 10000 rows is selected for the convenience and speed of data training. To do this, we use the randperm function, which generates random indices that are used to select appropriate samples of features (Xtrain_subset) and class labels (Y_train_subset). Next, three classical models are trained: LR using fitclinear, SVM using fitcsvm, and DT using fitctree. After that, the class labels are converted to the categorical format so that they can be used for deep learning (DL). Finally, the DNN architecture is defined, which consists of an input layer (featureInputLayer), two hidden fully connected layers with 100 and 50 neurons, respectively, ReLU activation functions, an output layer with two neurons, a softmaxLayer to convert the output values into probabilities, and a classificationLayerfor classification.
Next, we describe the process of training a DNN for data classification using Matlab, using training options such as the number of epochs (50), mini-batch size (32), and the ‘sgdm’ optimization algorithm (Figure 7).
During training, information on each iteration’s accuracy, loss, and time is displayed, allowing you to track the model’s progress. As you can see, at iteration 1401 out of 15600, the total elapsed time was 24 seconds, with the model being on the 5th epoch out of 50, and the number of iterations per epoch was 312. This allows us to estimate the speed of learning and the potential need to optimize the model parameters.
As a result, the training process ends when the maximum number of epochs is reached, displaying model performance metrics at each stage of training (Figure 8). The analysis of these metrics allows us to assess the stability and convergence rate of the model, as well as to identify possible over- or under-training problems. Based on this data, optimization parameters such as learning rate, number of neurons in hidden layers, or mini-packet size can be adjusted to improve the model’s overall performance.
Next, the four classification models (LR, SVM, DT, DNN) are predicted on the test dataset, and the accuracy of each model is calculated (Figure 9). Accuracy is calculated as the ratio of correct predictions to the total number of test cases. In addition, a confusion matrix is built for the DNN model, which allows you to visually assess the number of correct and incorrect predictions for each class.
The results obtained from the DNN confusion matrix show that the classification model has some problems with correctly recognizing queries of the ‘Normal’ class, as a significant proportion of such queries were misclassified as ‘Attack’ (39358 cases). At the same time, the model does a good job of classifying queries of the ‘Attack’ class, correctly identifying them as ‘Attack’ (39464 cases). Compared to other methods (LR, SVM, DT), DNN may have better results when configuring the right parameters and architecture, but it can also suffer from the problem of class imbalance. In addition, the accuracy of each model is displayed as a percentage. The results show that all four models (LR, SVM, DT, DNN) have similar accuracies, around 50% (Figure 10).
It is worth noting that the results for LR, SVM, and DT classification models show different efficiencies in classifying normal queries and attacks.
The LR model has a significant number of false positives and false negatives, which indicates difficulties with accurate classification. The SVM model improves accuracy by reducing the number of false positives, but there are still errors. At the same time, DT demonstrates the best accuracy among all models, reducing the number of misclassifications due to its flexibility in class distribution. The confusion matrices can evaluate these results, which distinguish between correctly and incorrectly classified queries as ‘Normal’ and ‘Attack’ (Figure 11).
Thus, LR showed lower efficiency than other models, with many false positive and false negative classifications. This indicates difficulties in accurately recognizing classes, particularly for attacks. LR has limited flexibility in class distribution, which may be the main reason for its errors. On the other hand, SVM has shown improvement over LR by reducing the number of false classifications. However, like LR, the SVM model still makes mistakes when classifying some queries, especially for the Normal class. It does a better job of distinguishing between classes due to the flexible use of the hyperplane. In turn, DT proved to be the most effective among the three models, reducing the number of false classifications due to its ability to adapt flexibly to the data. The DT model demonstrated better accuracy in recognizing both Normal and Attack queries. This may indicate that DT is better suited for solving problems with more complex relationships between classes. In addition, DNN showed similar results to the other methods but was the most susceptible to the problem of class imbalance. Although DNN can achieve better results when configured with the right parameters and architecture, its effectiveness is limited due to the need for DL and the difficulty in choosing the optimal settings.
The results of this study are focused on the development of a trained ML model for automatically
detecting and blocking dangerous requests in cybersecurity systems using LR, SVM, DT, and DNN
algorithms. At the same time, P. Bova et al. presented a quantitative model for assessing the
dangerous capabilities of artificial intelligence (AI), including mechanisms for early warning of
potential AI risks [
Like the work conducted, where ML algorithms such as SVM and LR are used, the study by S.
Khan et al. [
The current study also uses SVM and LR, but additionally considers DT and DNN algorithms, which allows achieving higher accuracy and reliability in automating real-time attack detection. This makes it possible to detect both known and new types of threats more efficiently, which is an important aspect of cybersecurity compared to the interface error-oriented methods in the work cited above.
The results of this work are aimed at automating the detection and blocking of dangerous
requests in cybersecurity systems with a trained ML model using LR, SVM, DT, and DNN
algorithms. The study by U. Ahmed et al. [
Unlike this study, which focuses on the ML model and its algorithms, the work of B. Ayyorgun
[
The study by G.A. López-Ramírez et al [
While M. Kim et al. developed ML models to predict the risk of outcomes in medical processes
[
The study compared the effectiveness of ML algorithms and methods of blocking dangerous
requests, and the DT-based model demonstrated the best results. In turn, the study by A. Aggarwal
et al. [
In addition to ML algorithms, the findings include an overview of methods for blocking
dangerous requests, such as supervised learning, signature methods, behavioral analysis, and
anomaly detection, as well as black-and-white lists. At the same time, the study by E. Peixoto et al
[
Similarly to this study, the study by M. D’Orazio et al. [
Similarly to this study, which focuses on ML and DNN for classifying dangerous queries, J.-J.
Hou et al. [
This study aims to develop methods for blocking dangerous queries, while Z. Su et al. [
It is worth noting that the study focuses on the development of an ML model in Matlab using LR, SVM, DT, and DNN classification algorithms. Currently, in the work of Z. Al Shara et al. [38] applied KMeans and Balanced Iterative Reducing and Clustering using Hierarchies (BIRCH) clustering algorithms to recover the links between pool requests and issues on GitHub, achieving 91.5% accuracy with BIRCH. Although both works use ML algorithms, the current approach focuses on classification to identify and block dangerous requests, while the other work focuses on clustering. Therefore, these studies complement each other, as classification and clustering are interrelated processes in data analysis. Classification allows you to assign categories to objects based on their characteristics while clustering groups similar objects. It can be useful for further improving classification models or identifying new, previously unknown patterns.
This work focuses on the application of ML algorithms using trained models with indicators of accuracy and adaptability, and K.E. Brown et al. [39] compare large language models (LLM), such as GPT-3.5 (Generative Pre-trained Transformer) and GPT-4, with traditional ML methods. The current work focuses on the effectiveness and stability of using classical ML methods and algorithms to accurately and reliably detect dangerous queries, which is an important aspect for ensuring security in cyberspace. In contrast to the work, this paper demonstrates the advantage in stability and adaptability of such methods, ensuring accuracy in detecting dangerous queries, which is critical for cybersecurity.
Like this work, the study by T. Matyja et al. [40] uses the Matlab environment. This paper discusses business process optimization using simulation methods, where the authors use SimEvents in Matlab/Simulink to model and generate artificial query sequences. They apply ML techniques to transform real data into random data. At the same time, the current work uses Matlab to apply classical ML algorithms, using such functions as fitclinear, fitcsvm, fitctree, and Training Progress. Thus, the results of the presented work confirm the conclusions of the current study, indicating the effectiveness of using ML in query analysis tasks and the convenience of using Matlab for this purpose [41–43].
This study has shown that ML effectively automates the classification of insecure requests, and the methods of supervised learning, signature analysis, behavioral analysis, and black- and whitelists have different efficiencies. In turn, M. Rahimifar et al. presented a method for predicting resource utilization and inference latency of NNs before their implementation on fieldprogrammable gate arrays (FPGAs) [44]. Although this approach is focused on optimizing hardware implementation, both papers emphasize the importance of automated evaluation of ML models to improve their efficiency [45].
Finally, the study demonstrated the effectiveness of DNNs in classifying insecure queries and provided a software implementation in Matlab. H. Bakır [46] proposed TuneDroid, a method for optimizing CNN configurations to improve Android malware detection through code visualization. While TuneDroid focuses on improving the accuracy of CNNs through Bayesian optimization, the current work proposes an approach to automated threat classification in general network traffic, not just for Android.
Thus, the proposed ML model for blocking dangerous requests outperforms the considered approaches due to the combination of accuracy, the ability to detect both known and new threats, and the optimal balance between performance and computational costs. The combination of different ML methods and algorithms allowed us to achieve high classification accuracy, and the use of a neural network ensured efficiency in detecting anomalies in real-time. Thus, the proposed approach has the potential to be integrated into modern cybersecurity systems, improving their ability to detect and neutralize threats and risks [47, 48] autonomously.
This work has shown that ML algorithms such as LR, SVM, DT, and DNN are effective tools for automated classification and blocking of dangerous requests in cybersecurity systems. The analysis showed that DT provides the highest classification accuracy due to its ability to recognize complex patterns in input data. SVM works well with large amounts of data and complex hyperplanes of separation, while LR is fast and easy to implement but inferior to other models in complex scenarios. At the same time, DNN has demonstrated high efficiency in detecting complex attack patterns, but its use requires significant computing resources.
MATLAB modeling based on the Network Traffic Dataset allowed us to evaluate the performance of the selected algorithms. Using the accuracy, F-score, precision, and recall metrics, we confirmed that DTs provide the best balance between computational speed and classification quality, while DNNs have the potential to detect complex and new attacks. The comparison also showed that combining several methods increases the overall effectiveness of a cybersecurity system. The considered methods of blocking dangerous requests allowed us to establish that the use of supervised learning based on DCS improves classification accuracy, as it adapts the choice of algorithm according to the nature of the input data. Signature analysis proved to be effective in recognizing known attacks, but its disadvantage is the inability to respond to new threats. Behavioral analysis and anomalous detection methods provide adaptability but have the risk of false positives. The use of black- and whitelists proved to be the least flexible but is useful as an additional defense mechanism.
Among the study’s limitations are the use of only one dataset, which may affect the generalizability of the results, and the high computational complexity of DNN training, making it difficult to apply them in real time. In addition, signature-based attack detection methods demonstrate limited effectiveness against new threats, and behavioral analysis has a risk of false positives.
Further research could focus on expanding and diversifying datasets, optimizing NNs to improve performance, and developing hybrid approaches that combine different classification and blocking methods to achieve greater efficiency in cybersecurity systems.
While preparing this work, the authors used the AI programs Grammarly Pro to correct text grammar and Strike Plagiarism to search for possible plagiarism. After using this tool, the authors reviewed and edited the content as needed and took full responsibility for the publication’s content. [38] Z. Al Shara, H. Eyal-Salman, A. Shatnawi, A.-D. Seriai, ML-Augmented Automation for Recovering Links Between Pull-Requests and Issues on GitHub, IEEE Access 99 (2023). doi:10.1109/ACCESS.2023.10015726 [39] K. E. Brown, C. Yan, Z. Li, X. Zhang, B. X. Collins, Y. Chen, E.W. Clayton, M. Kantarcioglu, Y.
Vorobeychik, B. A. Malin, Not the Models You Are Looking For: Traditional ML Outperforms LLMs in Clinical Prediction Tasks, medRxiv (2024). doi:10.1101/2024.12.03.24318400 [40] T. Matyja, Z. Stanik, K. Włodkowski, A Method of Generating Customer Requests in a Car Rental Simulation Model, Sci. J. Silesian Univ. of Technology, Series Transport 123 (2024) 191– 208. [41] V. Buhas, et al., Using Machine Learning Techniques to Increase the Effectiveness of Cybersecurity, in: Cybersecurity Providing in Information and Telecommunication Systems, vol. 3188, no. 2 (2021) 273–281. [42] V. Zhebka, et al., Methodology for Predicting Failures in a Smart Home based on Machine Learning Methods, in: Workshop on Cybersecurity Providing in Information and Telecommunication Systems, CPITS, vol. 3654 (2024) 322–332. [43] M. Adamantis, V. Sokolov, P. Skladannyi, Evaluation of State-Of-The-Art Machine Learning Smart Contract Vulnerability Detection Method, Advances in Computer Science for Engineering and Education VII, vol. 242 (2025) 53–65. doi:10.1007/978-3-031-84228-3_5 [44] M. Rahimifar, H. Ezzaoui Rahali, A. Corbeil Therrien, Rule4ML: An Open-Source Tool for Resource Utilization and Latency Estimation for ML Models on FPGA, Machine Learning: Science and Technology 6(1) (2025). doi:10.1088/2632-2153/ada71c [45] V. Zhebka, et al., Methodology for Choosing a Consensus Algorithm for Blockchain Technology, in: Workshop on Digital Economy Concepts and Technologies Workshop, DECaT, vol. 3665 (2024) 106–113. [46] H. Bakır, A New Method for Tuning the CNN Pre-Trained Models as a Feature Extractor for Malware Detection, Pattern Analysis and Applications 28(1) (2025). doi:10.1007/s10044-02401381-x [47] T. Korobeinikova, I. Tachenko, R. Chekhmestruk, P. Mykhaylov, O. Romanyuk, S. Romanyuk, A General Method of Risk Estimation, in: 13th Int. Conf. Advanced Computer Information Technologies (ACIT), Wrocław, Poland, 2023, 410–413. doi:10.1109/ACIT58437.2023.10275626 [48] V. Susukailo, I. Opirsky, O. Yaremko, Methodology of ISMS Establishment Against Modern Cybersecurity Threats, in: M. Klymash, M. Beshley, A. Luntovskyy (eds), Future Intent-Based Networking, Lecture Notes in Electrical Engineering, vol. 831, Springer, Cham, 2022. doi:10.1007/978-3-030-92435-5_15