Using XGBoost for Cyberattack Detection and Analysis in a Network Log System with ELK Stack
- 12 Downloads
Recently, cyberattackers have been developing more sophisticated ways to attack systems. Accordingly, identifying these attacks is getting more complicated in time. On many situations, network administrators were not capable of recognizing these attacks effectively or respond quickly. Whereas, to monitor and analyze the network log data which is very large and complicated is challenging. Therefore, in this case, there is a need to use artificial intelligence and machine learning techniques. In this paper, we develop a monitoring and analysis system for network log data. First, we used Elasticsearch, Logstash, and Kibana (ELK Stack) to monitor the network system. Second, we analyze the network log data use ‘eXtreme Gradient Boosting’ (XGBoost) to build a model of attack event detections. Finally, we use the XGBoost model to do cross-validated with the ELK Stack.
KeywordsCyber security Machine Learning ELK Stack XGBoost NetFlow Log
This work was sponsored by the Ministry of Science and Technology (MOST), Taiwan, under Grant No. 107-2221-E-029-008 and 107-2218-E-029-003.
- 1.Chen, T., Guestrin, C.: XGBoost: a scalable tree boosting system, 10 Jun 2016Google Scholar
- 2.Al-Qurishi, M., Alrubaian, M., Mizanur Rahman, Sk.Md., Alamri, A., Hassanab, M.M.: A prediction system of Sybil attack in social network using deep-regression model. Future Gener. Comput. Syst. 87, 743–753 (2018)Google Scholar
- 5.Prakash, T., Kakkar, M., Patel, K.: Geo identification of web users through logs using ELK stack. In: 6th International Conference - Cloud System and Big Data Engineering (2016)Google Scholar
- 9.Yuan, X., Li, C., Li, X.: Deep defense identifying DDoS attack via deep learning. In: 2017 IEEE International Conference on Smart Computing (2017)Google Scholar
- 13.Bagnasco, S., Berzano, D., Guarise, A., Lusso, S., Masera, M., Vallero, S.: Monitoring of IaaS and scientific applications on the Cloud using the Elasticsearch ecosystem. In: Journal of Physics: Conference Series, vol. 608, pp. 012016. IOP Publishing (2015)Google Scholar