Analysis of Machine Learning Models Based on Predictive Performance, Energy Consumption, and Carbon Emissions

Abstract

This study aims to evaluate intrusion detection models by jointly considering predictive performance and computational sustainability. The main problem addressed is that many intrusion detection studies emphasize classification accuracy while providing limited evidence about execution time, energy use, and carbon dioxide-equivalent emissions, even though these factors affect repeated training and practical deployment. The contribution of this work is a comparative assessment of four supervised learning models, Random Forest, Histogram-based Gradient Boosting, Support Vector Machine, and Extreme Gradient Boosting, under a unified experimental workflow. The methodology uses the Wednesday working-hours subset of the Canadian Institute for Cybersecurity intrusion detection dataset released in 2017, which contains benign traffic and several denial-of-service attack classes. The procedure includes dataset selection, data cleaning, preprocessing, stratified training and testing, model fitting, predictive evaluation, sustainability measurement, and comparative interpretation. The evaluation is supported by one workflow figure, tables describing predictive results and sustainability measurements, and comparative visualizations of classification and resource-efficiency outcomes. The results show that Extreme Gradient Boosting achieved the strongest overall classification performance, with an accuracy of 0.9994, macro recall of 0.9966, macro F1-score of 0.9956, macro precision of 0.9946, and one-versus-rest area under the curve of 0.9999, while requiring 0.002559 kilowatt-hours of energy and 11.83 seconds of execution time. Random Forest produced highly comparable predictive results with similarly low resource consumption. Histogram-based Gradient Boosting was the most efficient model in terms of time, energy use, and emissions, but its macro-level performance was substantially lower. Support Vector Machine produced acceptable predictive results but required substantially higher computational resources. These findings imply that sustainable intrusion detection should select models through a balanced evaluation of detection capability and computational cost rather than accuracy alone.