Can Machine Learning Turn Wazuh into an Infallible Detective?

In the digital world, cyber threats are getting smarter, and Security Operations Centers (SOCs) need sharper tools. Wazuh is a popular open‑source SIEM, but its rule‑based approach creates many false alarms, like a fire alarm that rings every time you turn on the stove. Researchers decided to give Wazuh a boost by adding two machine‑learning techniques: Random Forest (RF) and DBSCAN. RF works like a forest of decisions that, by analyzing data, can tell real danger from background noise, reaching 97.2 % accuracy. DBSCAN, on the other hand, groups similar events and cuts false positives to 0.082 %, with 91.06 % accuracy. Speed matters: both models process data in under 100 ms, and 95 % of events are handled within 500 ms. Scalability tests show the system stays stable up to 500 events per second, with an average latency of 45 ms. In practice, thanks to AI, Wazuh becomes faster, more precise, and less “noisy,” helping professionals focus on real threats.

The Random Forest model is an ensemble of decision trees that, through bagging, reduces variance and improves generalization. In this context, each tree is trained on a random subset of features extracted from security logs (e.g., source IP, destination port, malware signature). Combining predictions via majority voting yields an accuracy of 97.2 %, with a Receiver Operating Characteristic (ROC) curve showing an area under the curve (AUC) above 0.98, indicating excellent discrimination between benign and malicious events. DBSCAN (Density‑Based Spatial Clustering of Applications with Noise) was used to identify clusters of anomalous activity in a multidimensional space defined by temporal and frequency metrics. The ε (epsilon) parameter was optimized through grid search, while the minimum number of points (MinPts) was set to 5, ensuring detection of micro‑distributed attacks. DBSCAN's ability to label isolated points as "noise" drastically reduces false positives to 0.0821 %. Both models were implemented in Python using scikit‑learn libraries and integrated into Wazuh's pipeline via custom modules. To meet latency requirements, models were serialized in ONNX format and loaded into RAM, avoiding disk I/O. A throughput of 500 events per second was verified with Apache JMeter, maintaining an average latency of 45 ms, well below the 100 ms real‑time processing threshold. Additionally, robustness was assessed by perturbing input data (e.g., adding Gaussian noise) to ensure performance does not degrade significantly under incomplete or corrupted data scenarios. This hybrid approach demonstrates how combining supervised (RF) and unsupervised (DBSCAN) techniques can balance precision and resilience, providing a scalable solution ready for modern SOC environments.