Beta
362163

Data Mining-Driven Framework for Effective Firewall Log Management

Article

Last updated: 29 Dec 2024

Subjects

-

Tags

-

Abstract

firewall devices faces challenges, particularly in addressing performance issues due to evolving security threats. This paper presents a framework utilizing data mining techniques, specifically the Apriori and FPgrowth algorithms, to analyze extensive firewall logs. The proposed system extracts Juniper firewall logs from Security Information and Event Management (SIEM), deploying data mining algorithms to identify and address performance issues. The process involves discovering patterns, grouping item sets, and identifying related events within the telecom network's firewall logs. The study yields recommendations for managing firewall events, both individually and in critical event contexts, enabling network security administrators to automatically detect and review firewall performance problems. The FPgrowth algorithm identifies frequent itemsets, highlighting closely related events occurring together. The proposed data mining-driven framework demonstrates strong predictive power (R = 0.948, R Square = 0.898) and significant explanatory capability, evidenced by a high F-statistic (509.589, p < 0.0001) and impactful coefficients, particularly for the "actual frequency" variable. This framework enhances the efficiency of firewall log management, providing valuable insights for network security administrators.

DOI

10.21608/ifjsis.2024.259436.1051

Keywords

Firewalls, Network and Information Security, Data mining, Logs, and Event Management

Authors

First Name

Ahmed

Last Name

Gouda

MiddleName

Mohamed

Affiliation

Fayoum university

Email

ahmed.goda@te.eg

City

-

Orcid

-

First Name

Karim

Last Name

Emara

MiddleName

-

Affiliation

Faculty of Computer and Information Sciences, Ain Shams University.

Email

-

City

-

Orcid

-

First Name

Mohamed

Last Name

khafagy

MiddleName

H

Affiliation

Professor, computer science department, Fayoum university

Email

mhk00@fayoum.edu.eg

City

-

Orcid

0000-0003-0479-0516

First Name

Rasha

Last Name

Badry

MiddleName

M

Affiliation

Associate professor, information systems department, Fayoum university

Email

rasha.badry@fayoum.edu.eg

City

-

Orcid

-

Volume

2

Article Issue

2

Related Issue

52116

Issue Date

2024-12-01

Receive Date

2023-12-30

Publish Date

2024-12-01

Page Start

1

Page End

8

Print ISSN

2974-363X

Online ISSN

2974-3648

Link

https://lfjsis.journals.ekb.eg/article_362163.html

Detail API

https://lfjsis.journals.ekb.eg/service?article_code=362163

Order

362,163

Type

Original full papers (regular papers)

Type Code

2,705

Publication Type

Journal

Publication Title

Labyrinth: Fayoum Journal of Science and Interdisciplinary Studies

Publication Link

https://lfjsis.journals.ekb.eg/

MainTitle

Data Mining-Driven Framework for Effective Firewall Log Management

Details

Type

Article

Created At

18 Dec 2024