PREDICTING CYBER ATTACKS USING NETWORK LOGS

In modern times, where there is an abundance of connectivity in terms of digital technology, computers work through complex networks that increase their susceptibility to cyber-attacks. With time, businesses are becoming more dependent on the networking structure and, therefore, have become prone to such attacks, which are increasingly common and sophisticated, thus posing challenges to their control using traditional cybersecurity strategies. In most cases, traditional security frameworks are based on reaction methods since they only react to the incident after its occurrence. Apart from that, due to the time lag involved in detecting such threats, conventional security measures have proven to be ineffective in controlling the problem. This makes it necessary to implement more sophisticated means of preventing such attacks. Therefore, there is a growing demand for systems capable of predicting potential threats even before their occurrence. The proposed project will employ the detection and identification of cyber attacks by conducting extensive analysis of network logs. Network logs are used for storing data concerning communication in the network. By conducting thorough analysis of these logs, any abnormality can be identified and classified as a potential threat to security. In order to aid with the problem identification process, the authors of this paper make use of benchmark datasets, which include CICIDS2017 and NSL-KDD datasets. These are well-labeled data sets, which serve to provide valid network activities and different types of malicious network activities. Before applying any machine learning techniques on the datasets, extensive processing takes place in order to obtain important features of each case, which include source and destination IPs, network protocols, ports, sessions duration, and packet sizes. There were multiple machine learning techniques applied for the purpose of classifying normal and malicious network activity; these include Random Forest, Support Vector Machine, and Logistic Regression classification algorithms. The performance of each algorithm was measured according to commonly accepted metrics, namely accuracy, precision, recall, and F1 measure. From the results of the experiment, it becomes apparent that the proposed models were successful in the process of identifying malicious activities. This finding demonstrates great potential of data-driven intelligence-based solutions when it comes to network security.