Behavioral Analysis of Multi-core Random Forest Models: Case Study on Domain Name Randomness Detection

The field of cybersecurity is constantly evolving, necessitating the development of Machine Learning (ML) models for Domain Name System (DNS) anomaly detection that prioritize high accuracy alongside operational efficiency, particularly in real-time threat scenarios. This study explores the behavioral analysis of Random Forest, an Ensemble Learning technique, focusing on improving training time efficiency through the application of multi-core processing technologies. Our empirical research investigates the impact of modifications to Random Forest hyperparameters, such as the number of trees, parallel processing configurations, and tree splitting criteria, on training and classification times within multi-core environments. The findings demonstrate that while increasing the number of trees generally improves model accuracy, it also increases computational demands. However, the results reveal that leveraging parallel processing effectively mitigates these extended training times, offering a scalable approach for rapid DNS anomaly detection. By emphasizing these aspects of ML efficiency, this research contributes valuable insights into optimizing ML-driven cybersecurity tools, which is crucial for effectively combating sophisticated DGA-based malware threats.