On Construction of a Network Log System with Cyberattack Detection Using XGBoost on ELK Stack
碩士 === 東海大學 === 資訊工程學系 === 107 === With the development of artificial intelligence and machine learning technology, more and more cyber attacks have taken this as a development direction. According to statistics, the amount of data leaked and destroyed in the first half of 2018 increased by 72%compa...
Main Authors: | , |
---|---|
Other Authors: | |
Format: | Others |
Language: | en_US |
Published: |
2019
|
Online Access: | http://ndltd.ncl.edu.tw/handle/y5axr7 |
id |
ndltd-TW-107THU00394020 |
---|---|
record_format |
oai_dc |
spelling |
ndltd-TW-107THU003940202019-10-23T05:45:30Z http://ndltd.ncl.edu.tw/handle/y5axr7 On Construction of a Network Log System with Cyberattack Detection Using XGBoost on ELK Stack 使用 XGBoost 機器學習法進行攻擊檢測與分析並以 ELK Stack 視覺化於網路日誌系統 LAI, CING-HAN 賴慶翰 碩士 東海大學 資訊工程學系 107 With the development of artificial intelligence and machine learning technology, more and more cyber attacks have taken this as a development direction. According to statistics, the amount of data leaked and destroyed in the first half of 2018 increased by 72%compared with the same period in 2017. Of these events, most cases suffer from Advanced Progressive Penetration Attacks (APT). For the defense method of this type of attack, it is possible to detect and identify the attack event by observing the log data and analyzing whether it has abnormal behavior. This paper will be implemented as ELK Stack network log system (NetFlow Log) to visually analyze log data and present several kinds of network attack behavior characteristics for further analysis by managers. This paper will import historical log data, use ”extreme gradient enhancement” (XGBoost for machine learning), and use Keras for deep learning to build a model to detect whether the log has an attack event. The ultimate goal of this paper will be to find the best learning model through experiments in this case. Through experiments, it is confirmed that in this case, the XGBoost machine learning model has an accuracy rate of 96.01%for potential threats, and the full attack data set can achieve 100% recognition, which is better than RNN and DNN models. And this article will further combine the experimental results with the network log platform. The administrator can compare the model judgment results with the ELK Stack network log system for risk assessment. The log data used in this paper is continuous data, and the current data has reached more than 2TB and continues to increase. YANG, CHAO-TUNG LIU, JUNG-CHUN 楊朝棟 劉榮春 2019 學位論文 ; thesis 75 en_US |
collection |
NDLTD |
language |
en_US |
format |
Others
|
sources |
NDLTD |
description |
碩士 === 東海大學 === 資訊工程學系 === 107 === With the development of artificial intelligence and machine learning technology, more and more cyber attacks have taken this as a development direction. According to statistics, the amount of data leaked and destroyed in the first half of 2018 increased by 72%compared with the same period in 2017. Of these events, most cases suffer from Advanced Progressive Penetration Attacks (APT). For the defense method of this type of attack, it is possible to detect and identify the attack event by observing the log data and analyzing whether it has abnormal behavior. This paper will be implemented as ELK Stack network log system (NetFlow Log) to visually analyze log data and present several kinds of network attack behavior characteristics for further analysis by managers. This paper will import historical log data, use ”extreme gradient enhancement” (XGBoost for machine learning), and use Keras for deep learning to build a model to detect whether the log has an attack event. The ultimate goal of this paper will be to find the best learning model through experiments in this case. Through experiments, it is confirmed that in this case, the XGBoost machine learning model has an accuracy rate of 96.01%for potential threats, and the full attack data set can achieve 100% recognition, which is better than RNN and DNN models. And this article will further combine the experimental results with the network log platform. The administrator can compare the model judgment results with the ELK Stack network log system for risk assessment. The log data used in this paper is continuous data, and the current data has reached more than 2TB and continues to increase.
|
author2 |
YANG, CHAO-TUNG |
author_facet |
YANG, CHAO-TUNG LAI, CING-HAN 賴慶翰 |
author |
LAI, CING-HAN 賴慶翰 |
spellingShingle |
LAI, CING-HAN 賴慶翰 On Construction of a Network Log System with Cyberattack Detection Using XGBoost on ELK Stack |
author_sort |
LAI, CING-HAN |
title |
On Construction of a Network Log System with Cyberattack Detection Using XGBoost on ELK Stack |
title_short |
On Construction of a Network Log System with Cyberattack Detection Using XGBoost on ELK Stack |
title_full |
On Construction of a Network Log System with Cyberattack Detection Using XGBoost on ELK Stack |
title_fullStr |
On Construction of a Network Log System with Cyberattack Detection Using XGBoost on ELK Stack |
title_full_unstemmed |
On Construction of a Network Log System with Cyberattack Detection Using XGBoost on ELK Stack |
title_sort |
on construction of a network log system with cyberattack detection using xgboost on elk stack |
publishDate |
2019 |
url |
http://ndltd.ncl.edu.tw/handle/y5axr7 |
work_keys_str_mv |
AT laicinghan onconstructionofanetworklogsystemwithcyberattackdetectionusingxgboostonelkstack AT làiqìnghàn onconstructionofanetworklogsystemwithcyberattackdetectionusingxgboostonelkstack AT laicinghan shǐyòngxgboostjīqìxuéxífǎjìnxínggōngjījiǎncèyǔfēnxībìngyǐelkstackshìjuéhuàyúwǎnglùrìzhìxìtǒng AT làiqìnghàn shǐyòngxgboostjīqìxuéxífǎjìnxínggōngjījiǎncèyǔfēnxībìngyǐelkstackshìjuéhuàyúwǎnglùrìzhìxìtǒng |
_version_ |
1719275549015146496 |