{"id":13587,"date":"2025-10-16T11:27:30","date_gmt":"2025-10-16T09:27:30","guid":{"rendered":"https:\/\/www.ibisc.univ-evry.fr\/?page_id=13587"},"modified":"2025-10-16T11:49:51","modified_gmt":"2025-10-16T09:49:51","slug":"advance-2025-technical-session-1-full-papers-fp1-2","status":"publish","type":"page","link":"https:\/\/www.ibisc.univ-evry.fr\/en\/advance-2025-technical-session-1-full-papers-fp1-2\/","title":{"rendered":"ADVANCE 2025 – Technical Session 1 (Full Papers) – FP1.2"},"content":{"rendered":"
\n\t\t\t\t\t
\n\t\t\t\t\t\t

Upload PDF<\/strong><\/span><\/a><\/p>\n<\/div>

<\/div>
<\/div>

ADVANCE 2025 Web site<\/strong><\/a><\/p>\n<\/div>

ADVANCE 2025 Proceedings<\/strong><\/a><\/p>\n<\/div>

<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>
\n\t\t\t\t\t
\n\t\t\t\t\t\t

Comparison of Machine Learning and the ELK Stack for Automated Cyber Attack Detection: A Comparative Approach<\/strong><\/h2>\n

Gabrielly R. da Silva1<\/sup>, Bruno M. C. de Oliveira2<\/sup> and Reinaldo B. Braga1<\/sup><\/p>\n

1<\/sup> Brazilian Federal Institute of Education, Science and Technology, Fortaleza, Cear\u00e1, Brazil gabyrlsilva@gmail.com<\/a>, and reinaldobraga@gmail.com<\/a><\/p>\n

2<\/sup> Technische Universitat Dresden, Dresden, Germany bruno.oliveira@outlook.de<\/a><\/p>\n

DOI : https:\/\/doi.org\/10.48545\/advance2025-fullpapers-1_2<\/a><\/p>\n

Abstract<\/strong><\/h3>\n

The increasing complexity of cyberattacks has heightened the demand for effective detection mechanisms beyond traditional SIEM systems, which still depend on manual analysis. This study evaluates common classification algorithms\u2014Decision Tree (DT), Random Forest (RF), Support Vector Machine (SVM), and Naive Bayes (NB)\u2014and addresses a key limitation in existing datasets: the lack of detail on attack techniques. To overcome this, we simulated nine attack techniques and applied both manual and automated detection approaches using the ELK Stack and Artificial Intelligence (AI) models. While the manual method enhanced system visualization, it yielded accuracy below 39%. In contrast, automated classification achieved near-perfect results: DT and NB reached 100% accuracy, RF and SVM 99% in multi-class tasks; for binary classification, DT, RF, and NB reached 100%, with SVM at 99.98%. NB proved the most efficient in balancing accuracy, scalability, and resource use.<\/p>\n

Keywords<\/strong><\/h3>\n

SIEM, Machine Learning, Intrusion Detection System, ELK Stack.<\/p>\n<\/div>

<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":12,"featured_media":13585,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-13587","page","type-page","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/pages\/13587"}],"collection":[{"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/comments?post=13587"}],"version-history":[{"count":2,"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/pages\/13587\/revisions"}],"predecessor-version":[{"id":13593,"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/pages\/13587\/revisions\/13593"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/media\/13585"}],"wp:attachment":[{"href":"https:\/\/www.ibisc.univ-evry.fr\/en\/wp-json\/wp\/v2\/media?parent=13587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}