Authors : Ndubuisi Ifeanyichukwu Eleazar; Bilkisu L. Muhammad-Bello

Volume/Issue : Volume 11 - 2026, Issue 10 - October

DOI : https://doi.org/10.38124/ijisrt/26Oct433

Note : A published paper may take 4-5 working days from the publication date to appear in PlumX Metrics, Semantic Scholar, and ResearchGate.

Abstract : Small and Medium Enterprises (SMEs) face escalating cybersecurity threats yet commonly lack the financial and technical resources to deploy and manage enterprise-grade Security Information and Event Management (SIEM) systems. This study addresses that gap by designing, implementing, and evaluating a lightweight centralised SIEM that integrates rule-based correlation with Isolation Forest–based anomaly detection to improve threat detection and monitoring in SME environments. The system was built entirely from open-source components: Graylog served as the centralised log management platform while Python modules implemented the detection logic. Log events were structured as JSON, aggregated into fixed 5-minute time windows, and converted to numerical feature vectors for model training and evaluation. Testing was performed on a simulated SME-like dataset comprising normal operational activity and injected attack scenarios. The rule-based engine achieved perfect precision (1.000) but limited recall (0.333), correctly identifying all triggered alerts as true threats while missing four of six attack episodes. The Isolation Forest model achieved perfect recall (1.000) with an area under the ROC curve (AUC) of 0.937, detecting all six attack scenarios at an average Mean Time to Detect (MTTD) of 2.5 minutes, against an MTTD of 3.5 minutes for rules-only detection. The hybrid approach matched the Isolation Forest performance, confirming anomaly detection as the dominant component under these conditions. The findings demonstrate that open-source, lightweight SIEM solutions can deliver cost-effective and scalable cybersecurity monitoring for SMEs.

Keywords : SIEM; Anomaly Detection; Isolation Forest; Rule-Based Correlation; SME Cybersecurity; Network Monitoring.

References :

1. C. Henderson, "X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon," IBM, 2024.
2. D. Eliot, J. A. Marron, and S. Thorn, "Small business cybersecurity: Non-employer firms," NIST IR 7621 Rev. 2, 2025.
3. G. González-Granadillo, S. González-Zarzosa, R. Díaz, J. Araujo, F. Castillo, and E. de la Hoz, "Security information and event management (SIEM): Analysis, trends and usage in critical infrastructures," Sensors, vol. 21, no. 14, p. 4759, 2021.
4. Graylog, "Reducing mean time to investigate (MTTI) and respond (MTTR) with centralised logging," Graylog White Paper, 2025.
5. F. T. Liu, K. M. Ting, and Z.-H. Zhou, "Isolation forest," in Proc. 8th IEEE Int. Conf. Data Mining (ICDM), pp. 413–422, 2008.
6. ENISA, "Cybersecurity for SMEs: Challenges and recommendations," EU Agency for Cybersecurity, 2021.
7. M. Hassani, B. Parsa, and E. Nazari, "Systematic review of cybersecurity adoption in SMEs," Int. J. Cybersecurity, vol. 18, no. 3, pp. 54–67, 2021.
8. M. Nunes, J. Silva, and P. Costa, "Cybersecurity readiness in SMEs," Int. J. Cybersecurity, vol. 21, no. 3, pp. 178–191, 2022.
9. [M. H. Hossain et al., "Lightweight SIEM for resource-constrained organisations," IEEE Access, vol. 11, 2023.
10. A. Alshamrani, A. Alsaedi, and K. Alharthi, "Comparing open-source SIEM tools in a controlled testbed," J. Cybersecurity Solutions, vol. 35, no. 2, pp. 115–123, 2020.
11. S. Wang and T. Jones, "Open-source SIEM performance using controlled deployments," Security Technology and Systems, vol. 27, no. 4, pp. 167–182, 2022.
12. L. Caviglione et al., "Evaluated SIEM correlation rule performance," IEEE Trans. Inform. Forensics Security, vol. 16, 2021.
13. C. Chanikarn and P. Rattadilok, "Rule optimization algorithm for SIEM alerts," in Proc. ARES Conf., 2020.
14. M. Ahmed and M. S. Kim, "Hybrid statistical and log-based anomaly detection," Computers & Security, vol. 95, 2020.
15. D. Valdovinos, H. Ruiz, and R. García, "Log-based anomaly detection models: A systematic review," J. Cybersecurity Research, vol. 19, no. 6, pp. 245–263, 2021.
16. D. Koutroumpouchos, N. Papageorgiou, and G. Xylas, "Real-world SIEM deployments and operational challenges," J. Information Security, vol. 33, no. 2, pp. 80–98, 2020.
17. U. Tariq, I. Ahmed, A. K. Bashir, and K. Shaukat, "A critical cybersecurity analysis and future research directions for the IoT: A comprehensive review," Sensors, vol. 23, no. 8, p. 4117, 2023.
18. S. A. Chamkar, M. Zaydi, Y. Maleh, and N. Gherabi, "Improving threat detection in Wazuh using machine learning techniques," J. Cybersecurity and Privacy, vol. 5, no. 2, p. 34, 2025.
19. K. Peffers, T. Tuunanen, M. A. Rothenberger, and S. Chatterjee, "A design science research methodology for information systems research," J. Management Information Systems, vol. 24, no. 3, pp. 45–77, 2007.
20. M. Landauer, F. Skopik, M. Frank, W. Hotwagner, M. Wurzenberger, and A. Rauber, "AIT Log Data Set V2.0," Zenodo, 2022. doi:10.5281/zenodo.5789064