SoK: Applying Machine Learning in Security - A Survey

Abstract

The idea of applying machine learning(ML) to solve problems in security domains is almost 3 decades old. As information and communications grow more ubiquitous and more data become available, many security risks arise as well as appetite to manage and mitigate such risks. Consequently, research on applying and designing ML algorithms and systems for security has grown fast, ranging from intrusion detection systems(IDS) and malware classification to security policy management(SPM) and information leak checking. In this paper, we systematically study the methods, algorithms, and system designs in academic publications from 2008-2015 that applied ML in security domains. 98% of the surveyed papers appeared in the 6 highest-ranked academic security conferences and 1 conference known for pioneering ML applications in security. We examine the generalized system designs, underlying assumptions, measurements, and use cases in active research. Our examinations lead to 1) a taxonomy on ML paradigms and security domains for future exploration and exploitation, and 2) an agenda detailing open and upcoming challenges. Based on our survey, we also suggest a point of view that treats security as a game theory problem instead of a batch-trained ML problem.

Performance Comparison and Current Challenges of Using Machine Learning Techniques in Cybersecurity

“…There is an immense amount of work needed to improve the safety of ML from adversarial cyberattacks. Jiang et al in [37] examined the various publications on using machine learning techniques in cybersecurity from 2008 to early 2016. The authors also described that, despite the growing role of machine learning techniques in cybersecurity, the selection of appropriate and suitable machine learning technique for a specific underlying safety problem is still a challenging matter of grave concern.…”

Toward more generalized Malicious URL Detection Models

“…increasing type of attacks on the Internet [7]. More recently, endto-end solutions based on deep learning models have achieved state-of-the-art performance without explicitly utilizing domain knowledge or performing feature engineering.…”

Machine Learning (In) Security: A Stream of Problems

“…Limited evaluations are often seem in the cybersecurity context because collecting real malicious artifacts is a hard task, as most organizations do not share the threats that affect them to not reveal their vulnerabilities. On the other hand, a big dataset may result in long training times and produce too complex models and decision boundaries (according to the classifier and parameters used) that are not feasible in the reality (e.g., real-time models for resource-constrained devices), such as some deep learning models that usually requires a large amount of data to achieve good results [81]. As an analogy, consider that a dataset is a map and, for instance, represents a city.…”

“…Rieck et al [131] stated that only few research has produced practical results, presenting directions and perspectives of how to successfully link cybersecurity and Machine Learning and aiming at fostering research on intelligent security methods, based on a cyclic process that starts discovering new threats, followed by their analysis and the development of prevention measures. Jiang et al systematically studied some publications that applied ML in security domains, providing a taxonomy on ML paradigms and their applications in cybersecurity [81]. Salehi et al categorized existing strategies to detect anomalies in evolving data using unsupervised approaches, since label information is mostly unavailable in real-world applications [135].…”