The method of detecting malware-infected hosts analyzing firewall and proxy logs

A firewall prevents traffic entering and departing the domain it was supposed to protect. The logging feature keeps track of how the firewall handles different sorts of traffic. Monitoring and analyzing log files can assist IT businesses in improving the end-user reliability of their systems. This book chapter investigates and classifies the firewall log files using supervised machine learning algorithms. The main objective of this chapter is to examine firewall security by analyzing the firewall log files. Supervised machine learning classifiers such as support vector machine (SVM), Naïve Bayes, logistic regression and k-nearest neighbor (KNN) models are developed to classify the firewall log files. Feature selection using Ranker and Info_Gain_Attribute_Eval methods within the Weka tool is applied to derive the robust features from the data. Finally, a comparative analysis is performed to evaluate the efficiency of the supervised machine learning models. Results that, the Naïve Bayes Classifier attains the highest accuracy of 99.26% for the classification of firewall log files.

show abstract

The method of detecting malware-infected hosts analyzing firewall and proxy logs

Cited by 3 publications

References 1 publication

A Practical Experiment of the HTTP-Based RAT Detection Method in Proxy Server Logs

A Practical Experiment of the HTTP-Based RAT Detection Method in Proxy Server Logs

Detecting network applications using firewall logs

Classification of Firewall Log Files Using Supervised Machine Learning Techniques

Contact Info

Product

Resources

About