A Hybrid Random Forest–Support Vector Machine Model for Classifying Cyberattacks Using SSH Honeypot Log Data
DOI:
https://doi.org/10.15408/aism.v9i2.51928Keywords:
SSH Honeypot, Cowrie, attack classification, random forest, support vector machineAbstract
Secure Shell (SSH) is widely used for remote server administration; however, its exposure to public networks makes it a frequent target of cyberattack activities. This article presents an attack classification framework for Cowrie SSH Honeypot logs, using a hybrid Random Forest–Support Vector Machine approach. The raw logs were processed through log auditing, data cleaning, session reconstruction, class labeling, feature construction, feature selection, and model evaluation. The dataset consisted of 38 log files, 213,494 valid records, 29,099 unique sessions, and 1,618 unique source IP addresses. The analyzed attack categories included failed authentication, other suspicious interactions, successful compromise, and command execution. Random Forest ranked ten candidate behavioral features, selected the five highest-ranked features within each rolling fold, and generated time-aware out-of-fold class-probability estimates. The selected features and RF probability outputs were combined, standardized, and passed to a support vector machine with a radial basis function (RBF) kernel as the stage-1 classifier; sessions predicted as successful interactions were then refined into successful compromise or command execution based on observed command activity. Evaluation using eight rolling time-based folds achieved an accuracy of 99.65% ± 0.38%, a balanced accuracy of 97.02% ± 5.77%, and a macro F1-score of 97.84% ± 4.37% for the final four-class classification. The event_count, username_diversity, interarrival_std, and password_diversity features were selected in all folds. Theoretically, RF–SVM provides a stable session-level representation; in practice, it supports honeypot log triage and the prioritization of higher-risk SSH sessions.
Downloads
References
[1] R. Kaur, D. Gabrijelčič, and T. Klobučar, “Artificial intelligence for cybersecurity: Literature review and future research directions,” Inf. Fusion, vol. 97, Art. no. 101804, Apr. 2023, doi: 10.1016/j.inffus.2023.101804.
[2] O. Alnasser, J. Al Muhtadi, K. Saleem, and S. Shrestha, “Signature and anomaly based intrusion detection system for secure IoTs and V2G communication,” Alexandria Eng. J., vol. 125, pp. 424–440, Apr. 2025.
[3] M. Alshehri, “Dynamic cyber deception using AI-driven adaptive honeypot networks and context-aware behavioural analysis for proactive threat neutralization,” Ain Shams Eng. J., vol. 17, no. 4, Art. no. 104061, Mar. 2026, doi: 10.1016/j.asej.2026.104061.
[4] P. Beltrán-López, M. Gil Pérez, E. Vasilomanolakis, and P. Nespoli, “Reactive cyber deception : Stealth-based adaptive redirection to on-demand honeypots with AI-driven data generation,” Comput. Networks, vol. 281, Art. no. 112203, Mar. 2026, doi: 10.1016/j.comnet.2026.112203.
[5] A. Javadpour, F. Ja, T. Taleb, M. Shojafar, and C. Benzaïd, “A comprehensive survey on cyber deception techniques to improve honeypot performance,” Comput. Secur., vol. 140, Art. no. 103792, Mar. 2024, doi: 10.1016/j.cose.2024.103792.
[6] N. Ambrosio, C. Lista, G. Perrone, and S. Pietro Romano, “SMASH: An SDN-MTD framework for efficient honeypot deployment and insider threat mitigation,” Comput. Networks, vol. 269, Art. no. 111327, Jun. 2025, doi: 10.1016/j.comnet.2025.111327.
[7] S. Dadkhah et al., “CIC-YNU-IoTMal: A comprehensive multilayer dataset for static and dynamic analysis of IoT malware behavior,” Inf. Syst., vol. 140, Art. no. 102722, Apr. 2026, doi: 10.1016/j.is.2026.102722.
[8] V. Boiko and O. Niiakyi, “A 4-Month Dataset of Interactive SSH Honeypot Logs and Command Payloads,” Data Br., vol. 66, Art. no. 112860, May 2026, doi: 10.1016/j.dib.2026.112860.
[9] W. Borges, G. Ventorim, R. Vieira, I. Drago, and S. Villaça, “Building realistic cybersecurity datasets through a edge cloud testbed with cost-aware monitoring,” Comput. Networks, vol. 282, Art. no. 112303, Apr. 2026, doi: 10.1016/j.comnet.2026.112303.
[10] M. Ozdem, “A novel approach for real-time anomaly detection in dynamic computer networks using temporal graph networks and explainable artificial intelligence,” Alexandria Eng. J., vol. 132, pp. 369–382, Nov. 2025, doi: 10.1016/j.aej.2025.11.001.
[11] M. A. Shyaa, N. Farizah, Z. Zainol, R. Abdullah, and L. Alzubaidi, “Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems,” Eng. Appl. Artif. Intell., vol. 137, Art. no. 109143, Aug. 2024, doi: 10.1016/j.engappai.2024.109143.
[12] N. García-pedrajas and G. Cerruela-garcía, “MABUSE: A margin optimization based feature subset selection algorithm using boosting principles,” Knowledge-Based Syst., vol. 253, Art. no. 109529, 2022, doi: 10.1016/j.knosys.2022.109529.
[13] J. Bhayo, S. Attique, S. Hameed, A. Ahmed, J. Nasir, and D. Draheim, “Towards a machine learning-based framework for DDOS attack detection in software-defined IoT (SD-IoT) networks,” Eng. Appl. Artif. Intell., vol. 123, Art. no. 106432, May 2023, doi: 10.1016/j.engappai.2023.106432.
[14] I. Akbar and M. Faisal, “Perbandingan Analisis Sentimen PLN Mobile: Machine Learning vs. Deep Learning,” JOINTECS (Journal Inf. Technol. Comput. Sci., vol. 8, no. 1, pp. 1–10, 2024.
[15] Sarina et al., “Klasifikasi Penyakit Tanaman Nilam Berdasarkan Citra Daun Menggunakan GLCM dan SVM,” J. Inform. Prog., vol. 17, no. 2, pp. 12–22, 2025, doi: 10.56708/progres.v17i2.469.
[16] M. Faisal et al., “Utilizing Machine Learning-Based Decision- Making to Align Higher Education Curriculum with Industry Requirements,” Int. J. Mod. Educ. Comput. Sci., vol. 17, no. 4, pp. 1–25, 2025, doi: 10.5815/ijmecs.2025.04.01.
[17] Z. Noor, S. Hina, F. Hayat, and G. A. Shah, “Internet of Things An intelligent context-aware threat detection and response model for smart cyber-physical systems,” Internet of Things, vol. 23, Art. no. 100843, Jun. 2023, doi: 10.1016/j.iot.2023.100843.
[18] A. Singh, P. K. Chouhan, and G. S. Aujla, “SecureFlow: Knowledge and data-driven ensemble for intrusion detection and dynamic rule configuration in software-defined IoT environment,” Ad Hoc Networks, vol. 156, Art. no. 103404, 2024, doi: 10.1016/j.adhoc.2024.103404.
[19] P. Sarantos, J. Violos, and A. Leivadeas, “Enabling semi-supervised learning in intrusion detection systems,” J. Parallel Distrib. Comput., vol. 196, Art. no. 105010, Nov. 2024, doi: 10.1016/j.jpdc.2024.105010.
[20] T.-T.-H. Le, Y. Shin, M. Kim, and H. Kim, “Towards unbalanced multiclass intrusion detection with hybrid sampling methods and ensemble classification,” Appl. Soft Comput., vol. 157, Art. no. 111517, 2024, doi: 10.1016/j.asoc.2024.111517.
[21] M. A. Umar, Z. Chen, K. Shuaib, and Y. Liu, “Effects of feature selection and normalization on network intrusion detection,” Data Sci. Manag., vol. 8, no. 1, pp. 23–39, 2025, doi: 10.1016/j.dsm.2024.08.001.
[22] N. O. Aljehane, H. A. Mengash, S. B. H. Hassine, F. A. Alotaibi, A. S. Salama, and S. Abdelbagi, “Optimizing intrusion detection using intelligent feature selection with machine learning model,” Alexandria Eng. J., vol. 91, pp. 39–49, Feb. 2024, doi: 10.1016/j.aej.2024.01.073.
[23] A. A. Wardana, P. Sukarno, S. Basuki, and S. Budhi, “Federated Random Forest with Feature Selection for Collaborative Intrusion Detection in Internet of Things,” Procedia Comput. Sci., vol. 246, pp. 20–29, 2024, doi: 10.1016/j.procs.2024.09.193.
[24] T. Sowmya and M. A. E. A, “A novel stable feature selection algorithm for machine learning based intrusion detection system,” Procedia Comput. Sci., vol. 252, pp. 738–747, Jan. 2025, doi: 10.1016/j.procs.2025.01.034.
[25] A. Wakili and S. Bakkali, “A resilient IoT intrusion detection system using hybrid feature selection and explainable ensemble learning,” Results Eng., vol. 28, Art. no. 107392, Oct. 2025, doi: 10.1016/j.rineng.2025.107392.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Firrofiqil A'la Kadram, Muhammad Faisal, Runal Rezkiawan, Aedah Abd Rahman, Andi Makbul Syamsuri, Muhammad Syafaat S. Kuba
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
