Endpoint Detection And Response Systems (EDR) Enhancing Using Classification Techniques: A Machine Learning Approach

one of the most important issues in modern cyber-security environment is the Endpoint Detection and Response (EDR) systems, which provide real-time monitoring, detection, and responses to endpoint devices threats. The traditional EDR systems have many drawbacks and challenges such as high false positive rates, limited scalability, and inefficiencies in adapting to novel and unwell known threats. The main objective in this research is to overcome those limitations by integrating machine learning algorithms, such as Random Forest, Isolation Forest, and Gradient Boosting Machines (GBM) with the traditional EDR systems. This integration aims to enhance traditional EDR systems performance. CSE-CIC IDS2018 dataset was used in this research to check the best machine learning algorithm which should be combined with traditional EDR system to improve its performance. The dataset contains around 2.8 million labeled instances spanning various cyber-attack types. The researchers had employed a very strict preprocessing stage and then model optimization to build a reliable threats detection framework. The performance of traditional signature-based EDR systems was obviously improved after applying the proposed framework with higher accuracy, precision, recall, and F1 scores. Random Forest technique was selected to be combined with EDR upon its super performance. The results of the new framework shows a very trustable behavior of EDR especially in reducing false positives results, in addition to accuracy improvements in threats detection.