I Added ML Anamoly Detection to My Cybersecurity Tool - Here's What the Numbers Actually Showed
A few weeks ago, I built Log Sentinel, a log analysis dashboard that detects brute force attacks, directory scanning, and error spikes in Apache server logs using rule-based detectors. The rules worked well, but I kept wondering: what would a machine learning model catch that my rules missed? And more importantly, would ML actually be better? I spent two weeks adding an Isolation Forest model to…
After adding machine learning anomaly detection to my cybersecurity tool, I found out intriguing results about its performance. My Log Sentinel tool initially relied on rule-based detectors to identify brute force attacks, directory scanning, and error spikes in Apache server logs. While these rules were effective, I wanted to see if a machine learning model could uncover things the rules missed. I integrated an Isolation Forest model to compare its performance with the rule-based system.
The Isolation Forest operates differently from the rules by learning the normal traffic patterns from the data itself. It flags anything that deviates statistically from these patterns, transforming each IP address into a five-feature behavioral vector. This vector includes total requests made, error rate, number of unique paths visited, fraction of requests during nighttime hours, and average response size. Normalizing these features ensures the model treats all IPs fairly, regardless of scale.
To test the model, I created a labelled dataset of 230 IPs, with 200 normal and 30 attackers (broken down into brute force, directory scanning, and error spiking). By calculating precision, recall, and F1 score, I assessed the performance of both detectors. The rule-based system achieved perfect precision, recall, and F1 scores, while the Isolation Forest correctly identified all attackers (recall=1.0) but also flagged five innocent IPs (precision=0.857).
Initially, I was disappointed by the Isolation Forest's false positives. However, upon further reflection, I realized their value. The model identified five normal IPs that exhibited slightly unusual behavior, which might be significant in a real-world setting. Rules only catch anticipated attack patterns, while the ML model uncovers unexpected anomalies. Therefore, both detectors are essential in my cybersecurity tool.
My dashboard now displays both detectors' results, highlighting where they agree and disagree, providing insight into potentially interesting cases. To improve my evaluation in the future, I plan to use real labeled log data from a production environment instead of synthetic data. Additionally, I aim to compare other unsupervised algorithms like Local Outlier Factor and One-Class SVM with the Isolation Forest.
The live dashboard now showcases both detectors' results side-by-side, featuring confusion matrices and F1 scores for easy comparison.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
