Web servers generate access and error logs containing information about HTTP requests, response status codes, timestamps, requested resources, client addresses, and server errors. These records provide important information about server activities and help security analysts investigate suspicious events.
When multiple related events occur, individual log entries may not provide sufficient context to understand the complete incident. Correlating relevant events and classifying log records can help identify relationships between requests and organize security information for further investigation.
In this use case, Apache HTTP Server is deployed on Ubuntu Linux within an isolated VirtualBox laboratory environment. Kali Linux is used to generate controlled HTTP requests against the local Apache server. The resulting access and error logs are collected and processed for security analysis.
An existing public cybersecurity log dataset is used for machine-learning training and evaluation. Multinomial Naive Bayes classifies suitable log records using available, verified labels. The trained model is subsequently used to classify compatible Apache log records after applying the corresponding preprocessing and feature-extraction procedures.
Gemma 2 2B Instruct, running locally through Ollama, analyzes correlated log evidence and generates a possible root-cause explanation. SQLite stores the incident information, while Streamlit presents the collected logs, classification results, correlated events, and generated explanations for review.
Application/Service: Apache HTTP Server
Apache HTTP Server is the web server used in this use case. It is deployed on Ubuntu Linux within the isolated laboratory environment and generates access and error logs during normal operations and controlled security testing.
Web servers process HTTP requests from different clients and generate log records containing information about these interactions. When suspicious requests or server errors occur, security analysts must examine the available records to understand the activities and identify potentially related events.
Manual log analysis becomes difficult when numerous records are generated. Individual entries may reveal only one part of an incident, while related activities may appear across different timestamps, request paths, and response codes.
Apache HTTP Server
↓
Incoming HTTP Requests
↓
Access and Error Log Generation
↓
Large Volumes of Log Records
↓
Manual Log Examination
↓
Difficulty Identifying Related Events
↓
Incomplete Incident Context
↓
Time-Consuming Root-Cause Investigation
The proposed solution combines Multinomial Naive Bayes-based log classification with event correlation and local LLM analysis. The classifier categorizes suitable log records, while the local language model examines the correlated evidence and generates a possible explanation of the incident for analyst verification.
Specific Attack: Controlled HTTP-Based Security Testing
Controlled HTTP requests are generated from Kali Linux against the Apache HTTP Server deployed within the isolated laboratory. These requests include legitimate requests and selected security-testing requests that produce observable server responses and corresponding log entries.
The purpose of the controlled testing is to generate identifiable log evidence for examining how the classification, correlation, and root-cause analysis workflow processes different server activities.
Machine-Learning-Based Security Log Classification and Local LLM-Assisted Root-Cause Analysis
The primary security concept combines machine-learning classification, event correlation, and local language-model analysis to support cybersecurity incident investigation.
Security Log Classification : Multinomial Naive Bayes learns patterns from the selected, labelled cybersecurity log records. The trained model predicts categories for compatible records generated during the Apache security assessment.
Event Correlation : Related log entries are examined using available information such as timestamps, client addresses, request paths, response status codes, and predicted categories. This helps organize individual records into a more meaningful sequence of events.
Local LLM-Assisted Analysis: Gemma 2 2B Instruct analyzes the correlated log evidence and produces a possible explanation of the observed incident. The explanation is checked against the original records before being accepted as an investigative finding.
Public Cybersecurity Log Dataset
↓
Data Preprocessing
↓
Feature Extraction
↓
Multinomial Naive Bayes Training
↓
Apache Log Collection
↓
Log Classification
↓
Event Correlation
↓
Gemma 2 2B Instruct Analysis
↓
Possible Root-Cause Explanation
↓
Incident Evidence Storage
↓
Analyst Verification
The security concept defines the overall incident-analysis approach.
The following defensive mechanisms support the implementation.
Multinomial Naive Bayes classifies suitable log records using the patterns learned from the labelled training data.
The training records and newly collected Apache logs are processed using compatible feature-extraction procedures.
Related records are examined using available log fields and event information.
Gemma 2 2B Instruct examines correlated records and generates an evidence-based explanation of the possible incident cause.
SQLite stores the collected incident information, classification results, and generated explanations.
Streamlit displays the relevant log records, predicted categories, correlated events, and root-cause explanations.
The generated explanation is compared with the original Apache logs and associated classification results.
Apache HTTP Server provides the application environment in which HTTP requests are processed and security logs are generated.
Ubuntu hosts Apache HTTP Server and supports the log-processing and machine-learning components.
Kali Linux is used to generate controlled HTTP requests against the authorized laboratory server.
VirtualBox provides the isolated virtual-machine environment.
Python integrates dataset processing, model training, log collection, classification, event correlation, and LLM analysis.
Pandas organizes and processes the existing cybersecurity log dataset and collected Apache logs.
Scikit-learn provides the Multinomial Naive Bayes implementation and model-evaluation utilities.
Ollama runs the selected language model locally within the analysis environment
Gemma 2 2B Instruct is the local language model used for contextual incident analysis.
SQLite stores the incident information produced by the analysis workflow.
Streamlit provides the interface for displaying the analysis results.
cURL generates HTTP requests against the local Apache server.
Nmap identifies services exposed by the authorized laboratory target.
OWASP ZAP can be used to inspect HTTP traffic during authorized web-server testing.
Matplotlib or Plotly can be used to visualize classification and incident-analysis results.
Apache HTTP Server is deployed within an isolated Ubuntu and Kali Linux laboratory environment for controlled security testing.
An existing public cybersecurity log dataset is processed to prepare suitable labelled records for m achine-learning training and evaluation.
The Multinomial Naive Bayes model is trained and evaluated using the selected dataset, with actual classification metrics recorded to assess its performance.
Apache access and error logs are collected during normal application activity and controlled HTTP security testing.
Compatible Apache log records are processed and classified using the trained model, providing categorized information for further investigation.
Related log records are correlated using available event information, helping organize potentially connected activities into a chronological sequence.
Gemma 2 2B Instruct runs locally through Ollama and generates possible root-cause explanations from the correlated log evidence
SQLite stores the relevant incident records, classification results, correlated events, and generated explanations for subsequent review.
Streamlit presents the available analysis results through a dashboard, supporting examination of log classifications and possible incident causes.
The complete workflow demonstrates the integration of cybersecurity log classification, event correlation, local LLM-assisted root-cause analysis, incident storage, and analyst verification within a controlled laboratory environment.
Research Breakthrough Possible @S-Logix