Analysis of Cyberattack Trends and Proactive Defense Approaches Using Web Application Firewall Data

Abstract

This study aimed to 1) analyze the trends and characteristics of cyberattacks based on real incident data recorded by a Web Application Firewall (WAF); 2) assess risk levels and prioritize cyber threats affecting web application systems; and 3) propose proactive defense strategies aligned with the assessed risk levels. The dataset consisted of cyberattack logs collected from the WAF deployed at Kanchanaburi Rajabhat University between September and December 2025,

comprising 40,934 attack events categorized by attack type and 58,777 events categorized by system security status. Descriptive statistics and trend analysis were employed to examine attack frequency, distribution, patterns, and their impacts on the system.

The results indicated that SQL injection was the most prevalent attack type, accounting for 31.42% of all incidents, followed by web shell uploads and system command attacks. Analysis of system security status revealed that most events were classified as attacked; however, incidents categorized as compromised, infected, and bot-controlled, although fewer in number, caused substantially more severe impacts on the system. The findings suggest that effective cyber threat assessment should adopt a multidimensional perspective, taking into account the number of incidents, attack status, number of affected systems, and impact severity. Such an approach supports the design of proactive cyber defense strategies that are aligned with the organization’s operational context and enhances the systematic and effective management of web application security