Detecting network applications using firewall logs

Komadina, Adrian; Marović, Mihael; Groš, Stjepan

doi:10.23919/mipro55190.2022.9803394

Cited by 1 publication

(2 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This paper focuses on the use of a novel method to create logs containing attack-related records [ 2 ] and their use in combination with different anomaly detection methods to validate this approach [ 1 ]. The log generation method presented relies on real-world logs from the organization, augmented by domain knowledge, and eliminates the need for a dedicated testbed or installed security controls.…”

Section: Discussionmentioning

confidence: 99%

“…This paper is an extension of two papers originally presented at the 17th International Conference on Telecommunications (ConTEL) © 2023 IEEE [ 1 ] and the 16th European Workshop on System Security [ 2 ]. Parts of this paper appeared in Proceedings of the 17th International Conference on Telecommunications (ConTEL) © 2023 IEEE [ 1 ] and Proceedings of the 16th European Workshop on System Security [ 2 ].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Komadina,

Kovačević,

Štengl

et al. 2024

Sensors

Self Cite

View full text Add to dashboard Cite

Detecting anomalies in large networks is a major challenge. Nowadays, many studies rely on machine learning techniques to solve this problem. However, much of this research depends on synthetic or limited datasets and tends to use specialized machine learning methods to achieve good detection results. This study focuses on analyzing firewall logs from a large industrial control network and presents a novel method for generating anomalies that simulate real attacker actions within the network without the need for a dedicated testbed or installed security controls. To demonstrate that the proposed method is feasible and that the constructed logs behave as one would expect real-world logs to behave, different supervised and unsupervised learning models were compared using different feature subsets, feature construction methods, scaling methods, and aggregation levels. The experimental results show that unsupervised learning methods have difficulty in detecting the injected anomalies, suggesting that they can be seamlessly integrated into existing firewall logs. Conversely, the use of supervised learning methods showed significantly better performance compared to unsupervised approaches and a better suitability for use in real systems.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%