Dataset Generation for Development of Multi-Node Cyber Threat Detection Systems

Abstract

This paper presents a new approach to generate datasets for cyber threat research in a multi-node system. For this purpose, the proof-of-concept of such a system is implemented. The system will be used to collect unique datasets with examples of information hiding techniques. These techniques are not present in publicly available cyber threat detection datasets, while the cyber threats that use them represent an emerging cyber defense challenge worldwide. The network data were collected thanks to the development of a dedicated application that automatically generates random network configurations and runs scenarios of information hiding techniques. The generated datasets were used in the data-driven research workflow for cyber threat detection, including the generation of data representations (network flows), feature selection based on correlations, data augmentation of training datasets, and preparation of machine learning classifiers based on Random Forest and Multilayer Perceptron architectures. The presented results show the usefulness and correctness of the design process to detect information hiding techniques. The challenges and research directions to detect cyber deception methods are discussed in general in the paper.

An Investigation of Learning Model Technologies for Network Traffic Classification Design in Cyber Security Exercises

“…The trend is shifting towards analyzing existing cyber threat cases and replicating network traffic to reproduce them in cyberspace [22]. Vishwanath et al designed a method for stochastic generation of network traffic, duplication of actual network traffic, and delivering commands to test network applications [23], while Bieniasz et al proposed an approach for creating datasets for researching cyber threats on multi-node systems [24]. Thus, international research has been conducted on techniques to classify normal/abnormal traffic in a cyber training environment based on existing threat cases, and there is a need to build automated cyber training grounds through research on network traffic classification techniques.…”

Cybersecurity and Data Science

“…Bieniasz et al [10] proposed a new approach to generating datasets for cyber threat research in a multi-node system. Towards this purpose, the proof-of-concept of such a system was implemented and could be used to collect unique datasets with examples of information hiding techniques.…”