Utilizing windows event logs for malware detection using machine learning

As the occurrence of cyber threats rise continuously, Windows Operating System serve as both vulnerable sites and strongholds in today’s digital domain. This research delivers into an exhaustive inquiry on cyber-attack pattern focuses on filtering Windows environments coupled with a thorough investigation of state-of-the-art detection remedies. The research diligently scrutinizes widespread malware attack practices like advance malware techniques or customized hacks while breaking down their tactics and approaches and length. Windows logs are a crucial component of the Windows Operating System, capturing events and activities to provide administrators with valuable insights into system health and performance. Administrators often leverage Windows logs for troubleshooting, monitoring and security analysis, utilizing the rich data stored within them to ensure the stability and security of their Windows-based systems. Our model aims to detect malware that bypasses firewalls and traditional antimalware by analysing system event logs for behaviour anomalies, focusing on unauthorized access patterns rather than relying on IoCs alone. In this paper we used windows logs and convert the logs captured into a useful dataset to detect the malicious activity by the malwares and finding the best solution for prevent the attacks.