Challenges and Strategies in Forensic Investigation: Leveraging Technology for Digital Security Using Log/Event Analysis Method

Abstract

Cybersecurity threats continue to evolve, necessitating advanced techniques for network anomaly detection. This study developed a comprehensive methodology for detecting network anomalies by leveraging sophisticated log and event analysis using machine learning algorithms. By employing a Naive Bayes classification approach on a synthetic cybersecurity dataset comprising 40,000 entries with 25 unique features, the research aimed to enhance anomaly detection precision. The methodology involved meticulous data preprocessing, feature selection, and strategic model validation techniques, including cross-validation and external benchmarking. Comparative analysis with K-Nearest Neighbors and Support Vector Machine algorithms demonstrated the Naive Bayes method's superior performance, achieving a classification accuracy of 94.8%, an Area Under the Curve (AUC) of 0.949, and a Matthews Correlation Coefficient of 0.896. The study identified critical parameters influencing anomaly detection, such as source port characteristics and attack signatures. These findings contribute significant insights into machine learning-based network security strategies, offering a robust framework for early threat identification and mitigation.