Detecting Anomalies in Firewall Logs Using Artificially Generated Attacks

Abstract

Detecting anomalies in large networks is often a difficult task. Nowadays, many works employ machine learning techniques to address this problem, but much of this work often relies on synthetic or small datasets and uses only some specific machine learning techniques. In this research, we focus on analyzing firewall logs obtained from an industrial control network used in a production environment combined with generated anomalies representing real attacker steps in the network. We compared the results of unsupervised learning based on different models, subsets of attributes, feature construction methods, scaling methods, and aggregation levels, while the results of supervised learning were compared by using different classifiers at different aggregation levels. Based on the results of our experiments, we showed that the unsupervised learning method had a difficult task to detect our injected anomalies, which shows us that they are well integrated with the existing firewall logs. On the other hand, the injected anomalies allowed us to use supervised learning methods, and the results showed that using these methods gave much better results.