This study proposes an intrusion-prediction framework for e-Health information systems that combines structured web-log analysis, supervised machine learning, and Apache Spark-based distributed processing. A corpus of 1,000,000 labeled HTTP log instances collected from a university hospital web environment was preprocessed into security-relevant features, including request method, request/response type, packet size, status code, URL length, and parameter count. Using a stratified 80/20 train-test split and five-fold cross-validation on the training data, we compared K-Nearest Neighbors (KNN), Logistic Regression, and Decision Trees. KNN achieved the best held-out performance, with 95.66% accuracy, 91.79% precision, 93.93% recall, 92.85% F1-score, and a 3.60% false positive rate. Logistic Regression and Decision Trees reached accuracies of 85.30% and 83.20%, respectively. Spark also reduced runtime substantially at the 1,000,000-instance scale, lowering KNN processing time from 12.0 s to 6.5 s. The results show that combining big data infrastructure with carefully tuned machine learning can improve both detection quality and operational feasibility in hospital cybersecurity monitoring.
Abdelbaki et al. (Thu,) studied this question.