Machine learning application for intelligent threat classification in Cloudflare Bot Management firewall logs of university digital education infrastructure

- Gayibov, Artughrul (orcid.org/0009-0009-7349-0286), Gasimov, Vagif (orcid.org/0000-0003-3192-4225), Islamov, Islam (orcid.org/0000-0001-8645-0640), Mammadov, Jabir (orcid.org/0000-0003-3939-4708) and Gayibov, Seyran (orcid.org/0000-0001-7434-6248) (2026) Machine learning application for intelligent threat classification in Cloudflare Bot Management firewall logs of university digital education infrastructure Information Technologies and Learning Tools, 4 (114). pp. 186-201. ISSN 2076-8184

Text Artughrul Gayibov.pdf - Published Version Download (689kB)

Abstract

The object of this study is the automated classification of Cloudflare Bot Management (CBM) firewall log records collected from a university web application. The study addresses the problem of distinguishing potentially malicious requests from legitimate academic traffic in the digital educational infrastructure of a higher education institution. Static threshold-based firewall rules are often insufficient for analyzing multidimensional security indicators, including WAF machine-learning attack scores, bot-related signals, TLS fingerprint information, and request-level metadata. A comparative machine-learning framework was developed using six supervised classifiers: Random Forest (RF), Gradient Boosting (GB), Decision Tree (DT), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Gaussian Naive Bayes (GNB). The models were trained and evaluated on 24 engineered features extracted from 500 CBM log entries using a stratified 80/20 train-test split and 5-fold cross-validation. RF, GB, and DT achieved 100% test accuracy on the constructed dataset, while SVM, KNN, and GNB achieved 96.00%, 93.00%, and 44.00%, respectively. These results should be interpreted in the context of the proposed labelling procedure, because the target variable was derived from WAF score aggregation and the same group of WAF indicators was also used among the input features. Feature importance analysis showed that WAF machine-learning attack scores formed the dominant group of classification indicators. The Decision Tree model produced an interpretable threshold rule based on the normalized “wafMlAttackScore”. This rule is not presented as a fully deployed production firewall policy, but as a candidate rule that can support further expert validation and configuration of university WAF security policies. The proposed approach therefore contributes to the interpretation and secondary classification of CBM firewall logs in educational ICT security management.

Item Type:	Article
Keywords:	university network security; ensemble machine learning; WAF threat detection; firewall log analysis; educational ICT infrastructure.
Subjects:	Science and knowledge. Organization. Computer science. Information. Documentation. Librarianship. Institutions. Publications > 00 Prolegomena. Fundamentals of knowledge and culture. Propaedeutics > 004 Computer science and technology. Computing. Data processing > 004.01/.08 Special auxiliary subdivision for computing > 004.05 System and software quality Science and knowledge. Organization. Computer science. Information. Documentation. Librarianship. Institutions. Publications > 00 Prolegomena. Fundamentals of knowledge and culture. Propaedeutics > 004 Computer science and technology. Computing. Data processing > 004.9 Application-oriented computer-based techniques Science and knowledge. Organization. Computer science. Information. Documentation. Librarianship. Institutions. Publications > 3 Social Sciences > 37 Education > 37.01/.09 Special auxiliary table for theory, principles, methods and organization of education > 37.09 Organization of instruction Science and knowledge. Organization. Computer science. Information. Documentation. Librarianship. Institutions. Publications > 3 Social Sciences > 37 Education > 378 Higher education. Universities. Academic study
Divisions:	Institute for Digitalisation of Education > Generic resouse
Depositing User:	Алла 1 Алла Почтарьова
Date Deposited:	02 Nov 2026 16:48
Last Modified:	02 Nov 2026 16:48
URI:	https://lib.iitta.gov.ua/id/eprint/750680

Downloads

Actions (login required)

View Item