A few weeks ago, I built Log Sentinel, a log analysis dashboard that detects brute force attacks, directory scanning, and error spikes in Apache server logs using rule-based detectors. The rules worked well, but I kept wondering: what would a machine learning model catch that my rules missed? And more importantly, would ML actually be better?
I spent two weeks adding an Isolation Forest model to find out. The results were more interesting than I expected.
What I built
The ML upgrade adds a second detection layer on top of the existing rule-based system. Instead of checking specific conditions like "did this IP make 10+ failed logins?", the Isolation Forest learns what normal traffic looks like from the data itself and flags anything statistically unusual.
Before the model can run, I transform each IP address into a 5-feature behavioural vector:
