Classification of Firewall Logs Using Supervised Machine Learning Algorithms - As-Suhbani, Hajar Esmaeil; SD, Khamitkar (International Journal of Computer Sciences and Engineering, 2019)
Most operating systems services and network devices, such as Firewalls, generate huge amounts of network data in the form of logs and alarms. Theses log files can be used for network supervision and debugging. One important function of log files is logging security related or debug information, for example logging error logging and unsuccessful authentication. In this study, 500,000 instances, which have been generated from Snort and TWIDS, have been examined using 6 features. The Action attribute was selected as the class attribute. The “Allow” and “Drop” parameters have been specified for Action class. The firewall logs dataset is analyzed and the features are inserted to machine learning classifiers including Naive Bayes, kNN, One R and J48 using Spark in Weka tool. In addition, we compared the classification performance of these algorithms in terms of measurement metrics including Accuracy, F-measure and ROC values.