Analysis of Network log data using Machine Learning

Allagi, Shridhar; Rachh, Rashmi

doi:10.1109/i2ct45611.2019.9033737

Cited by 13 publications

(5 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As an example of a binary classification task, Allagi and Rachh [ 47 ] applied the Self-Organizing Feature Map algorithm and K-means to identify anomalies in the access patterns with supervised ML techniques based on the publicly available dataset in the UCI ML repository, while As-Suhbani and Khamitkar [ 48 ] proposed a meta-classifier model with four binary classifiers: K-Nearest Neighbor, Naive Bayes, J48, and One R using the network log dataset.…”

Section: Related Workmentioning

confidence: 99%

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Komadina,

Kovačević,

Štengl

et al. 2024

Sensors

View full text Add to dashboard Cite

Detecting anomalies in large networks is a major challenge. Nowadays, many studies rely on machine learning techniques to solve this problem. However, much of this research depends on synthetic or limited datasets and tends to use specialized machine learning methods to achieve good detection results. This study focuses on analyzing firewall logs from a large industrial control network and presents a novel method for generating anomalies that simulate real attacker actions within the network without the need for a dedicated testbed or installed security controls. To demonstrate that the proposed method is feasible and that the constructed logs behave as one would expect real-world logs to behave, different supervised and unsupervised learning models were compared using different feature subsets, feature construction methods, scaling methods, and aggregation levels. The experimental results show that unsupervised learning methods have difficulty in detecting the injected anomalies, suggesting that they can be seamlessly integrated into existing firewall logs. Conversely, the use of supervised learning methods showed significantly better performance compared to unsupervised approaches and a better suitability for use in real systems.

show abstract

Section: Related Workmentioning

confidence: 99%

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Komadina,

Kovačević,

Štengl

et al. 2024

Sensors

View full text Add to dashboard Cite

show abstract

“…The logging reports generated by firewalls have been the subject of extensive research over several decades. To cite a few recent works, Allagi et al [13] developed binary classifiers with Kmeans and Self-Organizing Feature Map (SOFM) algorithms to distinguish between normal and analogous records and achieved an accuracy of 92.7%. Cao et al [14] developed a system that utilizes a two-level approach for detecting anomalies in network log files.…”

Section: Literature Reviewmentioning

confidence: 99%

Firewall Log Classification: Leveraging Feature Selection and Stacking Ensemble

Monfared,

Borna

2024

Preprint

View full text Add to dashboard Cite

Firewall logs can provide valuable information about attempted security breaches and attacks. By classifying these logs, security teams can more easily identify patterns and potential threats, allowing them to take proactive measures to protect their systems. This paper presents a thorough analysis of the various features found in firewall log data. It focuses on selecting the most crucial features using feature selection techniques. The recommended feature sets are then assessed using stacking ensemble XGBoost to demonstrate their suitability. In order to compare the effectiveness of different feature selection techniques, we evaluated at least one member from each technique family using the proposed method. The experimental findings indicate that when Feature Shuffle Random Forest is used in conjunction with the proposed approach, the resulting model is the most accurate, achieving a performance evaluation metric of 99.93\%, signifying exceptional accuracy.

show abstract

“…Multiple research papers engaged in binary classification of network logs, distinguishing them as either normal or anomalous traffic. Allagi et al [10] investigation made use of a sizable dataset [11] with 22,614,256 records that was made available to the public by the UCI ML repository. K-means was used in their strategy to train the model, and the result was a model with an excellent accuracy of 97.2% and a False Positive Rate (FPR) of 2.7% on the sample dataset.…”

Section: Related Workmentioning

confidence: 99%

Cyber security Reinforcement through Firewall Log Analysis and Machine Learning

Afrah Fathima

2023

IJRITCC

View full text Add to dashboard Cite

Firewalls play a crucial role as a primary protective measure in safeguarding network security, effectively mitigating risks posed by external vulnerabilities and internal security breaches. This study presents a new framework that utilizes firewall log data to classify incoming data packets as either permitted or forbidden. The dataset utilized in this research is obtained from Department of CS&IT, MANU University and is subjected to a thorough data pre-processing procedure. This procedure includes several tasks such as managing missing values, encoding categorical variables, standardizing numerical attributes, and guaranteeing data coherence. In order to mitigate the issue of class imbalance within the target variable, we utilize a range of machine learning models and assess their efficacy through the examination of fundamental metrics such as accuracy, precision, recall, and F1-score. The results of our study demonstrate that the AdaBoost model has superior performance compared to other models, achieving a remarkable accuracy rate of 99.00%. This study demonstrates the application of machine learning methods to automatically identify the activities indicated in firewall logs, thereby improving the security of corporate networks. Through the implementation of automation, we facilitate a more dependable and efficient method of detecting and addressing possible risks, thereby strengthening network security measures and protecting valuable corporate information.

show abstract

Analysis of Network log data using Machine Learning

Cited by 13 publications

References 7 publications

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Firewall Log Classification: Leveraging Feature Selection and Stacking Ensemble

Cyber security Reinforcement through Firewall Log Analysis and Machine Learning

Contact Info

Product

Resources

About