A Comparative Study of Lightweight Machine Learning Models for Detecting Suspicious Network Traffic

Abstract: The increasing use of computer networks and Internet-based services has increased the risk of suspicious and potentially malicious network activities. Traditional monitoring approaches may require continuous manual analysis and may become difficult to apply to large volumes of traffic. This paper presents a comparative evaluation of five lightweight machine learning models for binary classification of network traffic as Normal or Attack. The evaluated models are Logistic Regression, Decision Tree, K-Nearest Neighbors (KNN), Random Forest, and Support Vector Machine (SVM). Experiments are conducted using the UNSW-NB15 dataset. A reproducible stratified sample of 20,000 training records and 10,000 testing records is used to keep the experiment computationally manageable. The models are evaluated using accuracy, precision, recall, F1-score, and confusion matrices. In the experiment, Random Forest achieves the highest accuracy (86.30%) and F1-score (88.81%), while SVM obtains the highest recall (99.47%). The findings show that conventional machine learning models can provide useful suspicious-traffic classification without requiring complex deep-learning architectures. Random Forest provides the best overall balance among the evaluated metrics under the experimental conditions of this study.

Keywords: Machine learning, network traffic, suspicious traffic detection, network security, classification, UNSW- NB15, intrusion detection.