ANALISIS PERBANDINGAN ALGORITMA RANDOM FOREST DAN ISOLATION FOREST DALAM DETEKSI ANCAMAN KEAMANAN SIBER

Abstract

Cybersecurity threats continue to increase in both number and complexity, necessitating a detection system capable of accurately and efficiently identifying malicious activity. This study aims to evaluate the performance of the Random Forest algorithm compared to the Isolation Forest in detecting cybersecurity threats by utilizing the Cybersecurity Threat Detection Logs Dataset. Experiments were conducted with three variations of data size: 100,000, 200,000, and 500,000 to assess the impact of data scale on model performance. The preprocessing process included feature selection, categorical data encoding, and the division of training and testing data using a stratified sampling technique. Model evaluation was performed using precision, recall, F1-score, and accuracy metrics based on a weighted average due to class imbalance in the dataset. The study findings revealed that Random Forest provided more stable and superior performance with precision, recall, F1-score, and accuracy values reaching 0.85 in all test scenarios. On the other hand, Isolation Forest showed good effectiveness in detecting anomalies, but also produced a higher false positive rate. Therefore, Random Forest is more suitable to be used as the main model for labeled cyber threat detection, while Isolation Forest can serve as a supporting system for anomaly detection.