A Data-Driven Machine Learning Framework for Cybersecurity Risk Prediction Using Behavioral and Temporal Features from Email Server Logs

Abstract

This study presents a data-driven machine learning framework for cybersecurity risk prediction using behavioral and temporal features extracted from email server logs. The dataset consists of 955 authentication records, including protocol types, login outcomes, error classifications, timestamps, and spam scores. Initial statistical analysis, comprising descriptive statistics, correlation analysis, and chi-square tests, was conducted to examine relationships among variables and feature relevance. Subsequently, supervised machine learning models, logistic regression, decision trees, and random forests, were implemented to classify cybersecurity risk events. To address class imbalance, the Synthetic Minority Oversampling Technique (SMOTE) was applied. Model performance was evaluated using accuracy, precision, recall, F1-score, and the Area Under the Receiver Operating Characteristic Curve (AUC). Experimental results indicate that the Random Forest model outperformed other models, achieving the highest AUC of 0.84, compared to 0.723 for logistic regression. The findings demonstrate that integrating behavioral and temporal features significantly enhances the detection of cybersecurity threats. This study highlights the effectiveness of ensemble learning methods in capturing complex patterns within log data and provides a robust framework for developing intelligent intrusion detection systems. The proposed approach offers practical implications for improving cybersecurity monitoring and risk prediction in real-world email-based communication environments.