Cyberattacks detection and analysis in a network log system using XGBoost with ELK stack

Yang, Chao‐Tung; Chan, Yu‐Wei; Liu, Jung-Chun; Kristiani, Endah; Lai, Cing-Han

doi:10.1007/s00500-022-06954-8

Cited by 7 publications

(3 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…XGBoost is characterized by high accuracy, strong flexibility, and prevention of overfitting. It is often used in data mining [41]. XGBoost belongs to the ensemble learning boosting algorithms, and is composed of multiple Gradient Boosting Decision trees (GBDT).…”

Section: Construction Of Nssa Classifier For the Iiotmentioning

confidence: 99%

AHP-Based Network Security Situation Assessment for Industrial Internet of Things

Guo

2023

Electronics

View full text Add to dashboard Cite

The Industrial Internet of Things (IIoT) is used in various industries to achieve industrial automation and intelligence. Therefore, it is important to assess the network security situation of the IIoT. The existing network situation assessment methods do not take into account the particularity of the IIoT’s network security requirements and cannot achieve accurate assessment. In addition, IIoT transmits a lot of heterogeneous data, which is subject to cyber attacks, and existing classification methods cannot effectively deal with unbalanced data. To solve the above problems, this paper first considers the special network security requirements of the IIoT, and proposes a quantitative evaluation method of network security based on the Analytic Hierarchy Process (AHP). Then, the average under-/oversampling (AUOS) method is proposed to solve the problem of unbalance of network attack data. Finally, an IIoT network security situation assessment classifier based on the eXtreme Gradient Boosting (XGBoost) is constructed. Experiments show that the situation assessment method proposed in this paper can more accurately characterize the network security state of the IIoT. The AUOS method can achieve data balance without generating too much data, and does not burden the training of the model. The classifier constructed in this paper is superior to the traditional classification algorithm.

show abstract

Section: Construction Of Nssa Classifier For the Iiotmentioning

confidence: 99%

AHP-Based Network Security Situation Assessment for Industrial Internet of Things

Guo

2023

Electronics

View full text Add to dashboard Cite

show abstract

“…Server logs, as primary sources of application activityrelated information, play a key role in the effort to detect and prevent attacks. However, challenges arise in distinguishing between normal and suspicious activities within typically large and heterogeneous server logs [1], [2], [3].…”

Section: Introductionmentioning

confidence: 99%

“…Web applications are susceptible to cyber-based attacks, and various security techniques have been developed to protect them. Prevention involves tool utilization, implementing security standards, and regularly assessing risk factors [1][15] [16].…”

Section: Introductionmentioning

confidence: 99%

Analysis of Attack Detection on Log Access Servers Using Machine Learning Classification: Integrating Expert Labeling and Optimal Model Selection

Ridwan,

Sembiring,

Setiawan

et al. 2024

SJI

View full text Add to dashboard Cite

Purpose: As the complexity and diversity of cyberattacks continue to grow, traditional security measures fall short in effectively countering these threats within web-based environments. Therefore, there is an urgent need to develop and implement innovative, advanced techniques tailored specifically to detect and address these evolving security risks within web applications.Methods: This research focuses on analyzing attack detection in log access servers using machine learning classification with two primary approaches: expert labeling integration and best model selection. Expert labeling determines whether log entries are safe or indicate an attack.Result: Validation in labeling was applied using different datasets to minimize errors and increase confidence in the resulting dataset. Experimental results show that the Decision Tree and Random Forest models have nearly identical accuracy rates, around 89.3%-89.4%, while the ANN model has an accuracy of 81%.Novelty: This study proposes a fusion of expert knowledge in labeling log entries with a rigorous process of selecting the best classification model. This integration has not been extensively explored in previous research, offering a novel approach to enhancing attack detection within web applications. The research contribution lies in the integration of expert security assessment and the selection of the best model for detecting attacks on server access logs, along with validating labels using various datasets from different log devices to enhance confidence in the analysis results.

show abstract

Design of Network Big Data Anti Attack System for Carbon Emission Measurement Based on Deep Learning

Zheng¹,

Ren²,

Wang³

et al. 2023

Machine Learning for Cyber Security

View full text Add to dashboard Cite

Cyberattacks detection and analysis in a network log system using XGBoost with ELK stack

Abstract: Noname manuscript No.

Cited by 7 publications

References 29 publications

AHP-Based Network Security Situation Assessment for Industrial Internet of Things

AHP-Based Network Security Situation Assessment for Industrial Internet of Things

Analysis of Attack Detection on Log Access Servers Using Machine Learning Classification: Integrating Expert Labeling and Optimal Model Selection

Design of Network Big Data Anti Attack System for Carbon Emission Measurement Based on Deep Learning

Contact Info

Product

Resources

About