Detecting Suspicious Network Activities with Zeek Dataset and Machine Learning-Assisted Framework
Open Access DepositedDetecting Suspicious Network Activities with Zeek Dataset and Machine Learning-Assisted Framework This praxis explores the application of supervised Machine Learning (ML) techniques to classify network traffic as benign or malicious by analyzing Zeek Hypertext Transport Protocol (HTTP) logs. By leveraging HTTP traffic data, the research aims to enhance cybersecurity through early threat detection, reduced false positives, and improved network security monitoring.Data preprocessing is performed on benign and malicious Zeek HTTP logs, followed by Random Forest (RF) and Logistic Regression (LR) models. RandomizedSearchCV and 3-fold cross-validation are used to hyperparameter tune and ensure model generalization. Raw data is transformed into meaningful features through feature engineering techniques, such as entropy calculations and frequency encoding, to improve the models' ability to differentiate benign and suspicious traffic. The models are evaluated using performance metrics such as accuracy, precision, recall, F1-score, ROC AUC (Receiver Operating Characteristic Area Under the Curve), and confusion matrices. LR achieved 88% accuracy, while the RF model achieved 95% accuracy. This implies that RF is more capable of capturing complex patterns in network traffic than linear models due to its ability to handle non-linear relationships. The research demonstrates that incorporating ML models like RF and applying feature engineering significantly improves the detection of suspicious network traffic. These findings provide valuable assistance to Security Operations Center (SOC) analysts by aiding in their triage efforts and enhancing their ability to prioritize and address potential threats effectively.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.