Cybersecurity data science: an overview from machine learning perspective

Sarker, Iqbal H.; Kayes, A. S. M.; Badsha, Shahriar; Alqahtani, Hamed; Watters, Paul A.; Ng, Alex

doi:10.1186/s40537-020-00318-5

Cited by 378 publications

(164 citation statements)

References 131 publications

Supporting

Mentioning

162

Contrasting

Unclassified

Order By: Relevance

“…Such context-aware models can be applied in various domains of today's interconnected world, especially in the environment of IoT and smartphones, such as smart cities, smart environments, home automation, eHealth, cybersecurity, and emergencies etc, where a number of contexts and data-driven services based on machine learning techniques are involved. Moreover, our analysis and discussion that we have done throughout the paper can also be helpful for the professionals of cybersecurity or mobile/IoT security domain, where high-dimension of security features are involved to build data-driven decision making [53].…”

Section: Discussionmentioning

confidence: 99%

Context pre-modeling: an empirical analysis for classification based user-centric context-aware predictive modeling

et al. 2020

Self Cite

View full text Add to dashboard Cite

Nowadays, machine learning classification techniques have been successfully used while building data-driven intelligent predictive systems in various application areas including smartphone apps. For an effective context-aware system, context pre-modeling is considered as a key issue and task, as the representation of contextual data directly influences the predictive models. This paper mainly explores the role of major context pre-modeling tasks, such as context vectorization by defining a good numerical measure through transformation and normalization, context generation and extraction by creating new brand principal components, context selection by taking into account a subset of original contexts according to their correlations, and eventually context evaluation, to build effective context-aware predictive models utilizing multi-dimensional contextual data. For creating models, various popular machine learning classification techniques such as decision tree, random forest, k-nearest neighbor, support vector machines, naive Bayes classifier, and deep learning by constructing a neural network of multiple hidden layers, are used in our study. Based on the context pre-modeling tasks and classification methods, we experimentally analyze user-centric smartphone usage behavioral activities utilizing their contextual datasets. The effectiveness of these machine learning context-aware models is examined by considering prediction accuracy, in terms of precision, recall, f-score, and ROC values, and has been made an empirical discussion in various dimensions within the scope of our study.

show abstract

Section: Discussionmentioning

confidence: 99%

Context pre-modeling: an empirical analysis for classification based user-centric context-aware predictive modeling

et al. 2020

Self Cite

View full text Add to dashboard Cite

show abstract

“…As mentioned, the detection of cyber-attacks is an established research area that has leveraged a range of technologies as it has evolved over the years [7] to cope with the exponential growth of cyber-attacks [8]. A range of ML-based models have been applied to the problem, including support vector machines, artificial neural networks, and k-means clustering [9].…”

Section: Background and Related Workmentioning

confidence: 99%

Utilising Flow Aggregation to Classify Benign Imitating Attacks

Hindy

Atkinson

Tachtatzis

et al. 2021

Sensors

View full text Add to dashboard Cite

Cyber-attacks continue to grow, both in terms of volume and sophistication. This is aided by an increase in available computational power, expanding attack surfaces, and advancements in the human understanding of how to make attacks undetectable. Unsurprisingly, machine learning is utilised to defend against these attacks. In many applications, the choice of features is more important than the choice of model. A range of studies have, with varying degrees of success, attempted to discriminate between benign traffic and well-known cyber-attacks. The features used in these studies are broadly similar and have demonstrated their effectiveness in situations where cyber-attacks do not imitate benign behaviour. To overcome this barrier, in this manuscript, we introduce new features based on a higher level of abstraction of network traffic. Specifically, we perform flow aggregation by grouping flows with similarities. This additional level of feature abstraction benefits from cumulative information, thus qualifying the models to classify cyber-attacks that mimic benign traffic. The performance of the new features is evaluated using the benchmark CICIDS2017 dataset, and the results demonstrate their validity and effectiveness. This novel proposal will improve the detection accuracy of cyber-attacks and also build towards a new direction of feature extraction for complex ones.

show abstract

“…Due to the big data generated from IoT devices, machine learning algorithms consider the optimal approach to deal with such data using their ability to deliver meaningful interpretations and predictions as well as deep analysis of the data patterns [20]. The authors of [21] stated that, to develop a computational approach that can detect different types of cyber-attacks, an intelligent data-driven intrusion detection system is required, by means of machine learning technique.…”

Section: Introductionmentioning

confidence: 99%

A Multi-Stage Classification Approach for IoT Intrusion Detection Based on Clustering with Oversampling

et al. 2021

View full text Add to dashboard Cite

Intrusion detection of IoT-based data is a hot topic and has received a lot of interests from researchers and practitioners since the security of IoT networks is crucial. Both supervised and unsupervised learning methods are used for intrusion detection of IoT networks. This paper proposes an approach of three stages considering a clustering with reduction stage, an oversampling stage, and a classification by a Single Hidden Layer Feed-Forward Neural Network (SLFN) stage. The novelty of the paper resides in the technique of data reduction and data oversampling for generating useful and balanced training data and the hybrid consideration of the unsupervised and supervised methods for detecting the intrusion activities. The experiments were evaluated in terms of accuracy, precision, recall, and G-mean and divided into four steps: measuring the effect of the data reduction with clustering, the evaluation of the framework with basic classifiers, the effect of the oversampling technique, and a comparison with basic classifiers. The results show that SLFN classification technique and the choice of Support Vector Machine and Synthetic Minority Oversampling Technique (SVM-SMOTE) with a ratio of 0.9 and the k value of 3 for k-means++ clustering technique give better results than other values and other classification techniques.

show abstract

Cybersecurity data science: an overview from machine learning perspective

Cited by 378 publications

References 131 publications

Context pre-modeling: an empirical analysis for classification based user-centric context-aware predictive modeling

Context pre-modeling: an empirical analysis for classification based user-centric context-aware predictive modeling

Utilising Flow Aggregation to Classify Benign Imitating Attacks

A Multi-Stage Classification Approach for IoT Intrusion Detection Based on Clustering with Oversampling

Contact Info

Product

Resources

About