Threat Visibility Optimisation

The complexity of cyber threats faced by any organisation managing critical infrastructure, such as those in the power grid and energy industry, requires accurate and adaptable detection methods. Traditional firewall log analysis often leverages machine learning, but the lack of explainability in such models can hinder their adoption in regulated environments. This paper presents a rule-based classification framework designed to analyse largely benign Fortigate firewall and internet authentication server logs, with a focus on identifying potential attack signatures from the OWASP Top 10 and other network and web-application based attacks. It addresses the limitations of traditional machine learning approaches in environments where attack indicators are sparse or infrequent. By implementing targeted rules that map attack characteristics to specific log fields, this approach offers a transparent, interpretable solution to uncover threats while maintaining a balance between accuracy and operational clarity. This study aims to establish a foundational framework for critical infrastructure agencies to apply rule-based methodologies in safeguarding systems against potential threats, achieving results comparable to manual analysis while significantly reducing the time and effort required.