Optimized Classification of Firewall Log Data using Heterogeneous Ensemble Techniques

Sharma, Deepanshu; Wason, Vansh; Johri, Prashant

doi:10.1109/icacite51222.2021.9404732

Cited by 8 publications

(5 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the benchmark model achieved a higher accuracy of 99.93%. Sharma et al [23] utilized a Heterogeneous ensemble model and obtained a Precision of 91%, Recall of 82%, and F1 score of 85%. The reported accuracy in their paper stands at an impressive 99.8%.…”

Section: Discussionmentioning

confidence: 99%

“…The results of the study indicate that KNN achieved the highest accuracy rate of 100% among the algorithms used. While the previous works discussed were conducted on different datasets, Ertam et al [20], AL-Behadili [21], Rahman et al [22], and Sharma et al [23] all researched the same dataset, which is a public network log obtained from Firat University and contains 65,532 instances. The best accuracy rate among these works was achieved by using a combination of machine learning algorithms, including DT, SVM, One Rule (One R), Artificial Neural Network (ANN), Particle Swarm Optimization (PSO), and ZeroR.…”

Section: Literature Reviewmentioning

confidence: 99%

See 1 more Smart Citation

Firewall Log Classification: Leveraging Feature Selection and Stacking Ensemble

Monfared,

Borna

2024

Preprint

View full text Add to dashboard Cite

Firewall logs can provide valuable information about attempted security breaches and attacks. By classifying these logs, security teams can more easily identify patterns and potential threats, allowing them to take proactive measures to protect their systems. This paper presents a thorough analysis of the various features found in firewall log data. It focuses on selecting the most crucial features using feature selection techniques. The recommended feature sets are then assessed using stacking ensemble XGBoost to demonstrate their suitability. In order to compare the effectiveness of different feature selection techniques, we evaluated at least one member from each technique family using the proposed method. The experimental findings indicate that when Feature Shuffle Random Forest is used in conjunction with the proposed approach, the resulting model is the most accurate, achieving a performance evaluation metric of 99.93\%, signifying exceptional accuracy.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Literature Reviewmentioning

confidence: 99%

Firewall Log Classification: Leveraging Feature Selection and Stacking Ensemble

Monfared,

Borna

2024

Preprint

View full text Add to dashboard Cite

show abstract

“…The best accuracy of 99.839% was obtained using the DT model. Likewise, Sharma et al [16] used the same dataset and set of 11 features to train their models. In this study, they used five algorithms, LR, KNN, DT, SVM, and stochastic gradient descent classifier.…”

Section: Literature Reviewmentioning

confidence: 99%

Classification of Firewall Log Data Using Multiclass Machine Learning Models

et al. 2022

View full text Add to dashboard Cite

These days, we are witnessing unprecedented challenges to network security. This indeed confirms that network security has become increasingly important. Firewall logs are important sources of evidence, but they are still difficult to analyze. Artificial Intelligence (AI), Machine Learning (ML), and Deep Learning (DL) have emerged as effective in developing robust security measures due to the fact that they have the capability to deal with complex cyberattacks in a timely manner. This work aims to tackle the difficulty of analyzing firewall logs using ML and DL by building multiclass ML and DL models that can analyze firewall logs and classify the actions to be taken in response to received sessions as “Allow”, “Drop”, “Deny”, or “Reset-both”. Two sets of empirical evaluations were conducted in order to assess the performance of the produced models. Different features set were used in each set of the empirical evaluation. Further, two extra features, namely, application and category, were proposed to enhance the performance of the proposed models. Several ML and DL algorithms were used for the evaluation purposes, namely, K-Nearest Neighbor (KNN), Naïve Bayas (NB), J48, Random Forest (RF) and Artificial Neural Network (ANN). One interesting reading in the experimental results is that the RF produced the highest accuracy of 99.11% and 99.64% in the first and the second experiments respectively. Yet, all other algorithms have also produced high accuracy rates which confirm that the proposed features played a significant role in improving the firewall classification rate.

show abstract

“…Several works have explored the utilization of firewall event logs to uncover meaningful patterns. Sharma et al [11] presented an optimized solution for classifying firewall data packets using machine learning. Their study involved the analysis of 65,532 instances of log files, employing advanced ensemble models with five well-known machine learning classification algorithms.…”

Section: Introductionmentioning

confidence: 99%

“…The proposed framework in this paper faces several challenges in light of existing studies that leverage firewall event logs to uncover meaningful patterns. Notable works in this domain include Sharma et al [11] optimization for classifying firewall data packets using machine learning, where an ensemble model achieved a precision value of 91% and an accuracy score of 99.8% based on the analysis of 65,532 log files. Jin et al [12] integrated machine learning into decision tree filtering rules, utilizing optimized C4.5 algorithms to predict optimal rankings for firewall filtering rule table attributes, resulting in enhanced firewall efficiency.…”

Section: Introductionmentioning

confidence: 99%

Data Mining-Driven Framework for Effective Firewall Log Management

Gouda,

khafagy,

Badry

2024

Labyrinth: Fayoum Journal of Science and Interdisciplinary Stud

View full text Add to dashboard Cite

devices face challenges, particularly in addressing performance issues due to evolving security threats. This paper presents a framework utilizing data mining techniques, specifically the Apriori and FPgrowth algorithms, to analyze extensive firewall logs. The proposed system extracts Juniper firewall logs from Security Information and Event Management (SIEM), deploying data mining algorithms to identify and address performance issues. The process involves discovering patterns, grouping item sets, and identifying related events within the telecom network's firewall logs. The study yields recommendations for managing firewall events, both individually and in critical event contexts, enabling network security administrators to automatically detect and review firewall performance problems. The FPgrowth algorithm identifies frequent itemsets, highlighting closely related events occurring together. The proposed data miningdriven framework demonstrates strong predictive power (R = 0.948, R Square = 0.898) and significant explanatory capability, evidenced by a high F-statistic (509.589, p < 0.0001) and impactful coefficients, particularly for the "actual frequency" variable. This framework enhances the efficiency of firewall log management, providing valuable insights for network security administrators.

show abstract

Optimized Classification of Firewall Log Data using Heterogeneous Ensemble Techniques

Cited by 8 publications

References 17 publications

Firewall Log Classification: Leveraging Feature Selection and Stacking Ensemble

Firewall Log Classification: Leveraging Feature Selection and Stacking Ensemble

Classification of Firewall Log Data Using Multiclass Machine Learning Models

Data Mining-Driven Framework for Effective Firewall Log Management

Contact Info

Product

Resources

About