Developer Compares Rule-Based and ML Anomaly Detection in Custom Log Analysis Tool

A software developer added an Isolation Forest machine learning model to Log Sentinel, a self-built Apache log analysis dashboard originally designed to detect brute force attacks and directory scans using rule-based logic. The experiment used a labelled dataset of 230 IP addresses — 200 normal and 30 simulated attackers — to fairly evaluate both detection approaches. Rule-based detectors achieved perfect precision and recall because the evaluation data was deliberately structured around known attack patterns the rules were written to catch. The ML model matched on recall by catching all 30 attackers but produced five false positives, flagging normal IPs with statistically unusual behaviour. The developer concluded both methods are complementary: rules reliably catch known threats with no false alarms, while ML can surface unexpected anomalies that no predefined rule would cover.