Internet Usage Patterns Mining from Firewall Event Logs

Polpinij, Jantima; Namee, Khanista

doi:10.1145/3322134.3322155

Cited by 8 publications

(3 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Their study showed that smartphone users can be classified by their gender, smoking habits, software programming experience, etc. Polpinij and Namee [7] proposed the Generalized Sequential Patter (GSP) algorithm for sequential pattern mining. They used GSP for extracting interesting patterns of inappropriate user behaviors in real event logs from an organization in Thailand, which improved the QoS of the Internet service.…”

Section: Related Workmentioning

confidence: 99%

Anomalous Telecom Customer Behavior Detection and Clustering Analysis Based on ISP’s Operating Data

Zheng

Liu

2020

IEEE Access

View full text Add to dashboard Cite

Mobile networks and smart phones have become ubiquitous in our daily life. Large amount of customer related telecom data from various sources are generated every day, from which diversified behavior patterns can be revealed, including some anomalous behaviors that are vicious. It becomes increasingly important to achieve both efficient and effective customer behavior analysis based on the telecom big data. In this paper, the Multi-faceted Telecom Customer Behavior Analysis (MTCBA) framework for anomalous telecom customer behavior detection and clustering analysis is proposed. In this framework, we further design the hierarchical Locality Sensitive Hashing-Local Outlier Factor (hierarchical LSH-LOF) scheme for suspicious customer detection, and the Autoencoders with Factorization Machines (FM-AE) structure for dimension reduction to achieve more efficient clustering. Hierarchical LSH-LOF is an improved algorithm of LOF, in which we design a hierarchical LSH process that selects the approximate k nearest neighbors from coarse to fine by gradually narrowing down the scope. Experiments show its superiority over KD-tree w.r.t searching speed. FM-AE exploits Factorization Machines for learning second order feature interactions, which we prove to be useful by designing comparative experiments with five dimension reduction algorithms. With the proposed MTCBA framework, efficient and effective telecom customer behavior analysis including anomalous customer behavior detection and clustering analysis is performed on the real world telecom operating data provided by one of the major Internet service providers (ISPs) in China. Meanwhile, interpretable clustering results of six clusters are obtained to provide valuable information for the precision marketing of telecom operators, criminal combating, and social credit system construction.

show abstract

Section: Related Workmentioning

confidence: 99%

Anomalous Telecom Customer Behavior Detection and Clustering Analysis Based on ISP’s Operating Data

Zheng

Liu

2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Their study analyzed 93 firewall rules using machine learning algorithms, with KNN demonstrating the best performance. In the context of internet usage behavior, authors in one paper emphasized the importance of users' behavior for quality of service analysis and proposed a method using the Generalized Sequential Pattern (GSP) algorithm for data mining of web access logs stored in firewalls [16]. Another paper proposed a technique for analyzing the integration relations between IPv6 firewall rules and detecting anomalies using a formal verification configuration and the SMT solver Z3 [17].…”

Section: Introductionmentioning

confidence: 99%

“…M. A. M. Ariffin et al [23] implements unsupervised data mining approach to analyze the network traffic trend and type of traffic in campus network. J. Polpinij, & K. Namee [24] propose a ( Generalized Sequential Pattern (GSP) algorithm) , which is used for sequential pattern mining. Real event logs from an organization in Thailand were used in the study, and the results revealed significant findings that can lead to improvements in increasing the quality of service of the internet service.These studies collectively highlight the complexity of leveraging firewall event logs and implementing data mining techniques, indicating challenges related to precision, accuracy, feature selection, and rule set optimization.…”

Section: Introductionmentioning

confidence: 99%

Data Mining-Driven Framework for Effective Firewall Log Management

Gouda,

khafagy,

Badry

2024

Labyrinth: Fayoum Journal of Science and Interdisciplinary Stud

View full text Add to dashboard Cite

devices face challenges, particularly in addressing performance issues due to evolving security threats. This paper presents a framework utilizing data mining techniques, specifically the Apriori and FPgrowth algorithms, to analyze extensive firewall logs. The proposed system extracts Juniper firewall logs from Security Information and Event Management (SIEM), deploying data mining algorithms to identify and address performance issues. The process involves discovering patterns, grouping item sets, and identifying related events within the telecom network's firewall logs. The study yields recommendations for managing firewall events, both individually and in critical event contexts, enabling network security administrators to automatically detect and review firewall performance problems. The FPgrowth algorithm identifies frequent itemsets, highlighting closely related events occurring together. The proposed data miningdriven framework demonstrates strong predictive power (R = 0.948, R Square = 0.898) and significant explanatory capability, evidenced by a high F-statistic (509.589, p < 0.0001) and impactful coefficients, particularly for the "actual frequency" variable. This framework enhances the efficiency of firewall log management, providing valuable insights for network security administrators.

show abstract

A Systematic Literature Review on Relationship Between Internet Usage Behavior and Internet QoS in Campus

Zhang

Bashah

2022

Mobile Web and Intelligent Information Systems

View full text Add to dashboard Cite

Internet Usage Patterns Mining from Firewall Event Logs

Cited by 8 publications

References 12 publications

Anomalous Telecom Customer Behavior Detection and Clustering Analysis Based on ISP’s Operating Data

Anomalous Telecom Customer Behavior Detection and Clustering Analysis Based on ISP’s Operating Data

Data Mining-Driven Framework for Effective Firewall Log Management

A Systematic Literature Review on Relationship Between Internet Usage Behavior and Internet QoS in Campus

Contact Info

Product

Resources

About