Comparison of Machine Learning and the ELK Stack for Automated Cyber Attack Detection: A Comparative Approach
Gabrielly R. da Silva1, Bruno M. C. de Oliveira2 and Reinaldo B. Braga1
1 Brazilian Federal Institute of Education, Science and Technology, Fortaleza, Ceará, Brazil , and
2 Technische Universitat Dresden, Dresden, Germany
DOI : https://doi.org/10.48545/advance2025-fullpapers-1_2
Abstract
The increasing complexity of cyberattacks has heightened the demand for effective detection mechanisms beyond traditional SIEM systems, which still depend on manual analysis. This study evaluates common classification algorithms—Decision Tree (DT), Random Forest (RF), Support Vector Machine (SVM), and Naive Bayes (NB)—and addresses a key limitation in existing datasets: the lack of detail on attack techniques. To overcome this, we simulated nine attack techniques and applied both manual and automated detection approaches using the ELK Stack and Artificial Intelligence (AI) models. While the manual method enhanced system visualization, it yielded accuracy below 39%. In contrast, automated classification achieved near-perfect results: DT and NB reached 100% accuracy, RF and SVM 99% in multi-class tasks; for binary classification, DT, RF, and NB reached 100%, with SVM at 99.98%. NB proved the most efficient in balancing accuracy, scalability, and resource use.
Keywords
SIEM, Machine Learning, Intrusion Detection System, ELK Stack.