MACHINE LEARNING APPLICATION FOR INTELLIGENT THREAT CLASSIFICATION IN CLOUDFLARE BOT MANAGEMENT FIREWALL LOGS OF UNIVERSITY DIGITAL EDUCATION INFRASTRUCTURE

Abstract

The object of this study is the automated classification of Cloudflare Bot Management (CBM) firewall log records collected from a university web application. The study addresses the problem of distinguishing potentially malicious requests from legitimate academic traffic in the digital educational infrastructure of a higher education institution. Static threshold-based firewall rules are often insufficient for analyzing multidimensional security indicators, including WAF machine-learning attack scores, bot-related signals, TLS fingerprint information, and request-level metadata. A comparative machine-learning framework was developed using six supervised classifiers: Random Forest (RF), Gradient Boosting (GB), Decision Tree (DT), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Gaussian Naive Bayes (GNB). The models were trained and evaluated on 24 engineered features extracted from 500 CBM log entries using a stratified 80/20 train-test split and 5-fold cross-validation. RF, GB, and DT achieved 100% test accuracy on the constructed dataset, while SVM, KNN, and GNB achieved 96.00%, 93.00%, and 44.00%, respectively. These results should be interpreted in the context of the proposed labelling procedure, because the target variable was derived from WAF score aggregation and the same group of WAF indicators was also used among the input features. Feature importance analysis showed that WAF machine-learning attack scores formed the dominant group of classification indicators. The Decision Tree model produced an interpretable threshold rule based on the normalized “wafMlAttackScore”. This rule is not presented as a fully deployed production firewall policy, but as a candidate rule that can support further expert validation and configuration of university WAF security policies. The proposed approach therefore contributes to the interpretation and secondary classification of CBM firewall logs in educational ICT security management.