{"id":"https://openalex.org/W7221069087","doi":"https://doi.org/10.15408/aism.v9i2.51928","title":"A Hybrid Random Forest\u2013Support Vector Machine Model for Classifying Cyberattacks Using SSH Honeypot Log Data","display_name":"A Hybrid Random Forest\u2013Support Vector Machine Model for Classifying Cyberattacks Using SSH Honeypot Log Data","publication_year":2026,"publication_date":"2026-10-09","ids":{"openalex":"https://openalex.org/W7221069087","doi":"https://doi.org/10.15408/aism.v9i2.51928"},"language":"en","primary_location":{"id":"doi:10.15408/aism.v9i2.51928","doi":"https://doi.org/10.15408/aism.v9i2.51928","is_oa":true,"landing_page_url":"https://doi.org/10.15408/aism.v9i2.51928","pdf_url":"https://journal.uinjkt.ac.id/index.php/aism/article/download/51928/19718","source":{"id":"https://openalex.org/S4210198747","display_name":"Applied Information System and Management (AISM)","issn_l":"2621-2536","issn":["2621-2536","2621-2544"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Information System and Management (AISM)","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://journal.uinjkt.ac.id/index.php/aism/article/download/51928/19718","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5157996394","display_name":"Firrofiqil A'la Kadram","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I3132802412","display_name":"Muhammadiyah University of Makassar","ror":"https://ror.org/03kc2e209","country_code":"ID","type":"education","lineage":["https://openalex.org/I3132802412"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Firrofiqil A'la Kadram","raw_affiliation_strings":["Universitas Muhammadiyah Makassar"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universitas Muhammadiyah Makassar","institution_ids":["https://openalex.org/I3132802412"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100748014","display_name":"Muhammad Faisal","orcid":"https://orcid.org/0000-0003-1469-9468","observed_orcids":["https://orcid.org/0000-0003-1469-9468"]},"institutions":[{"id":"https://openalex.org/I3132802412","display_name":"Muhammadiyah University of Makassar","ror":"https://ror.org/03kc2e209","country_code":"ID","type":"education","lineage":["https://openalex.org/I3132802412"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Muhammad Faisal","raw_affiliation_strings":["Universitas Muhammadiyah Makassar"],"raw_orcid":"https://orcid.org/0000-0003-1469-9468","affiliations":[{"raw_affiliation_string":"Universitas Muhammadiyah Makassar","institution_ids":["https://openalex.org/I3132802412"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000417113","display_name":"Runal Rezkiawan","orcid":"https://orcid.org/0009-0002-4886-381X","observed_orcids":["https://orcid.org/0009-0002-4886-381X"]},"institutions":[{"id":"https://openalex.org/I3132802412","display_name":"Muhammadiyah University of Makassar","ror":"https://ror.org/03kc2e209","country_code":"ID","type":"education","lineage":["https://openalex.org/I3132802412"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Runal Rezkiawan","raw_affiliation_strings":["Universitas Muhammadiyah Makassar"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universitas Muhammadiyah Makassar","institution_ids":["https://openalex.org/I3132802412"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121239475","display_name":"Aedah Abd Rahman","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I55283087","display_name":"Asia e University","ror":"https://ror.org/031my5009","country_code":"MY","type":"education","lineage":["https://openalex.org/I55283087"]}],"countries":["MY"],"is_corresponding":false,"raw_author_name":"Aedah Abd Rahman","raw_affiliation_strings":["Asia e University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Asia e University","institution_ids":["https://openalex.org/I55283087"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133293123","display_name":"Andi Makbul Syamsuri","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I3132802412","display_name":"Muhammadiyah University of Makassar","ror":"https://ror.org/03kc2e209","country_code":"ID","type":"education","lineage":["https://openalex.org/I3132802412"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Andi Makbul Syamsuri","raw_affiliation_strings":["Universitas Muhammadiyah Makassar"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universitas Muhammadiyah Makassar","institution_ids":["https://openalex.org/I3132802412"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5123641518","display_name":"Muhammad Syafaat S. Kuba","orcid":"https://orcid.org/0009-0004-6227-6528","observed_orcids":["https://orcid.org/0009-0004-6227-6528"]},"institutions":[{"id":"https://openalex.org/I3132802412","display_name":"Muhammadiyah University of Makassar","ror":"https://ror.org/03kc2e209","country_code":"ID","type":"education","lineage":["https://openalex.org/I3132802412"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Muhammad Syafaat S. Kuba","raw_affiliation_strings":["Universitas Muhammadiyah Makassar"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universitas Muhammadiyah Makassar","institution_ids":["https://openalex.org/I3132802412"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.2769,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.84292029,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":"9","issue":"2","first_page":"289","last_page":"296"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ssh-honeypot","display_name":"SSH honeypot","score":0.859000027179718},{"id":"https://openalex.org/keywords/cowries","display_name":"Cypraeidae","score":0.8230000138282776},{"id":"https://openalex.org/keywords/cyberattack-classification","display_name":"cyberattack classification","score":0.9649999737739563},{"id":"https://openalex.org/keywords/command-execution","display_name":"command execution","score":0.9330000281333923},{"id":"https://openalex.org/keywords/behavioral-characteristics","display_name":"behavioral characteristics","score":0.621999979019165},{"id":"https://openalex.org/keywords/feature-selection","display_name":"feature selection","score":0.8560000061988831},{"id":"https://openalex.org/keywords/session-reconstruction","display_name":"session reconstruction","score":0.5929999947547913},{"id":"https://openalex.org/keywords/gaussian-kernel","display_name":"Gaussian kernel","score":0.6899999976158142}],"concepts":[{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.666700005531311},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.6664999723434448},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6424999833106995},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.6208999752998352},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5364000201225281},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5184000134468079},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5138999819755554},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.46959999203681946},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.4643000066280365},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.451200008392334},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.4066999852657318},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.4027999937534332},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.39070001244544983},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.37450000643730164},{"id":"https://openalex.org/C2780814629","wikidata":"https://www.wikidata.org/wiki/Q327353","display_name":"System administrator","level":2,"score":0.3677000105381012},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.366100013256073},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.3650999963283539},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.33719998598098755},{"id":"https://openalex.org/C33499554","wikidata":"https://www.wikidata.org/wiki/Q1417134","display_name":"Dashboard","level":2,"score":0.3237000107765198},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.31839999556541443},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.3140000104904175},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.31029999256134033},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.30820000171661377},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.30649998784065247},{"id":"https://openalex.org/C761482","wikidata":"https://www.wikidata.org/wiki/Q118093","display_name":"Transmission (telecommunications)","level":2,"score":0.2939999997615814},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C166955791","wikidata":"https://www.wikidata.org/wiki/Q629579","display_name":"Macro","level":2,"score":0.2847000062465668},{"id":"https://openalex.org/C12426560","wikidata":"https://www.wikidata.org/wiki/Q189569","display_name":"Basis (linear algebra)","level":2,"score":0.28220000863075256},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.267300009727478},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.26660001277923584},{"id":"https://openalex.org/C98856871","wikidata":"https://www.wikidata.org/wiki/Q1588488","display_name":"Radial basis function","level":3,"score":0.2644999921321869},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.26420000195503235},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.2637999951839447},{"id":"https://openalex.org/C125168437","wikidata":"https://www.wikidata.org/wiki/Q7625184","display_name":"Structured support vector machine","level":3,"score":0.25780001282691956},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.25760000944137573},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2549000084400177},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.25270000100135803}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.15408/aism.v9i2.51928","doi":"https://doi.org/10.15408/aism.v9i2.51928","is_oa":true,"landing_page_url":"https://doi.org/10.15408/aism.v9i2.51928","pdf_url":"https://journal.uinjkt.ac.id/index.php/aism/article/download/51928/19718","source":{"id":"https://openalex.org/S4210198747","display_name":"Applied Information System and Management (AISM)","issn_l":"2621-2536","issn":["2621-2536","2621-2544"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Information System and Management (AISM)","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.15408/aism.v9i2.51928","doi":"https://doi.org/10.15408/aism.v9i2.51928","is_oa":true,"landing_page_url":"https://doi.org/10.15408/aism.v9i2.51928","pdf_url":"https://journal.uinjkt.ac.id/index.php/aism/article/download/51928/19718","source":{"id":"https://openalex.org/S4210198747","display_name":"Applied Information System and Management (AISM)","issn_l":"2621-2536","issn":["2621-2536","2621-2544"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Information System and Management (AISM)","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7221069087.pdf","grobid_xml":"https://content.openalex.org/works/W7221069087.grobid-xml"},"referenced_works_count":23,"referenced_works":["https://openalex.org/W4288808030","https://openalex.org/W4362704894","https://openalex.org/W4377691173","https://openalex.org/W4379928215","https://openalex.org/W4391046411","https://openalex.org/W4391589697","https://openalex.org/W4392364798","https://openalex.org/W4393028950","https://openalex.org/W4401538487","https://openalex.org/W4401732041","https://openalex.org/W4404261179","https://openalex.org/W4404835327","https://openalex.org/W4407345606","https://openalex.org/W4410979868","https://openalex.org/W4412947381","https://openalex.org/W4416019444","https://openalex.org/W7084144894","https://openalex.org/W7085728866","https://openalex.org/W7133299146","https://openalex.org/W7135180095","https://openalex.org/W7150998871","https://openalex.org/W7152008146","https://openalex.org/W7161420353"],"related_works":["https://openalex.org/W7220771986","https://openalex.org/W7161827796","https://openalex.org/W4312394704","https://openalex.org/W7125200101","https://openalex.org/W2587459291","https://openalex.org/W7161919445","https://openalex.org/W4411592876","https://openalex.org/W4361251690","https://openalex.org/W4226062848","https://openalex.org/W2551072658"],"abstract_inverted_index":{"Secure":[0],"Shell":[1],"(SSH)":[2],"is":[3],"widely":[4],"used":[5],"for":[6,31,196],"remote":[7],"server":[8],"administration;":[9],"however,":[10],"its":[11],"exposure":[12],"to":[13,133],"public":[14],"networks":[15],"makes":[16],"it":[17,222],"a":[18,37,134,139,181,189,216],"frequent":[19],"target":[20],"of":[21,68,177,184,192,230],"cyberattack":[22],"activities.":[23],"This":[24],"article":[25],"presents":[26],"an":[27,175],"attack":[28,86],"classification":[29],"framework":[30],"Cowrie":[32],"SSH":[33,232],"Honeypot":[34],"logs,":[35],"using":[36,169],"hybrid":[38],"Random":[39,99],"Forest\u2013Support":[40],"Vector":[41],"Machine":[42],"approach.":[43],"The":[44,65,84,121,201],"raw":[45],"logs":[46],"were":[47,128,154,208],"processed":[48],"through":[49],"log":[50,70,225],"auditing,":[51],"data":[52],"cleaning,":[53],"session":[54],"reconstruction,":[55],"class":[56],"labeling,":[57],"feature":[58,60],"construction,":[59],"selection,":[61],"and":[62,78,96,115,124,131,188,205,227],"model":[63],"evaluation.":[64],"dataset":[66],"consisted":[67],"38":[69],"files,":[71],"213,494":[72],"valid":[73],"records,":[74],"29,099":[75],"unique":[76,80],"sessions,":[77],"1,618":[79],"source":[81],"IP":[82],"addresses.":[83],"analyzed":[85],"categories":[87],"included":[88],"failed":[89],"authentication,":[90],"other":[91],"suspicious":[92],"interactions,":[93],"successful":[94,152,158],"compromise,":[95],"command":[97,161,166],"execution.":[98],"Forest":[100],"ranked":[101],"ten":[102],"candidate":[103],"behavioral":[104],"features,":[105],"selected":[106,122,209],"the":[107,146,197,228],"five":[108],"highest-ranked":[109],"features":[110,123,207],"within":[111],"each":[112],"rolling":[113,171],"fold,":[114],"generated":[116],"time-aware":[117],"out-of-fold":[118],"class-probability":[119],"estimates.":[120],"RF":[125],"probability":[126],"outputs":[127],"combined,":[129],"standardized,":[130],"passed":[132],"support":[135],"vector":[136],"machine":[137],"with":[138],"radial":[140],"basis":[141],"function":[142],"(RBF)":[143],"kernel":[144],"as":[145,151],"stage-1":[147],"classifier;":[148],"sessions":[149],"predicted":[150],"interactions":[153],"then":[155],"refined":[156],"into":[157],"compromise":[159],"or":[160],"execution":[162],"based":[163],"on":[164],"observed":[165],"activity.":[167],"Evaluation":[168],"eight":[170],"time-based":[172],"folds":[173],"achieved":[174],"accuracy":[176,183],"99.65%":[178],"\u00b1":[179,186,194],"0.38%,":[180],"balanced":[182],"97.02%":[185],"5.77%,":[187],"macro":[190],"F1-score":[191],"97.84%":[193],"4.37%":[195],"final":[198],"four-class":[199],"classification.":[200],"event_count,":[202],"username_diversity,":[203],"interarrival_std,":[204],"password_diversity":[206],"in":[210,220],"all":[211],"folds.":[212],"Theoretically,":[213],"RF\u2013SVM":[214],"provides":[215],"stable":[217],"session-level":[218],"representation;":[219],"practice,":[221],"supports":[223],"honeypot":[224],"triage":[226],"prioritization":[229],"higher-risk":[231],"sessions.":[233]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2026-10-10T00:00:00"}