THREAT DETECTION IN FIREWALL LOGS USING FEATURE SELECTION AND ENSEMBLE LEARNING

The firewall serves as the first line of defense in network security, responsible for monitoring and filtering data traffic. However, firewalls remain limited in accurately detecting threats, often generating false positives and false negatives, where legitimate traffic is misclassified as attacks or vice versa. Despite numerous studies that apply machine learning to firewall log analysis, the challenge of accurately distinguishing between benign and malicious activities remains. Existing methods often struggle with high rates of false positives and false negatives, particularly in complex, real-world network environments. This study aims to bridge this gap by combining feature selection and stacking-based ensemble learning, which has been underexplored in addressing the issue of misclassification in firewall logs. Our feature selection approach combines Random Forest feature importance with mutual information, while the ensemble framework employs a stacking strategy that integrates Iterative Dichotomiser 3 (ID3), Random Forest (RF), and Extreme Gradient Boosting (XGBoost), with XGBoost serving as the meta‐learner. Experiments were conducted on two datasets: Palo Alto firewall logs from an Indonesian government agency and a public dataset from the UCI Machine Learning Repository, to evaluate the model’s generalization performance. The results demonstrate that the ensemble learning method reduces false positives and false negatives, achieving 99.97 % accuracy on the primary dataset and 99.87 % on the secondary dataset, representing a 7.14 % reduction in misclassification compared with standalone machine learning algorithms. This work contributes to the development of a robust and efficient threat detection system suitable for deployment in both governmental and public network environments.