Tackling imbalanced data in cybersecurity with transfer learning: a case with ROP payload detection

Abstract

In recent years, deep learning gained proliferating popularity in the cybersecurity application domain, since when being compared to traditional machine learning methods, it usually involves less human efforts, produces better results, and provides better generalizability. However, the imbalanced data issue is very common in cybersecurity, which can substantially deteriorate the performance of the deep learning models. This paper introduces a transfer learning based method to tackle the imbalanced data issue in cybersecurity using return-oriented programming payload detection as a case study. We achieved 0.0290 average false positive rate, 0.9705 average F1 score and 0.9521 average detection rate on 3 different target domain programs using 2 different source domain programs, with 0 benign training data sample in the target domain. The performance improvement compared to the baseline is a trade-off between false positive rate and detection rate. Using our approach, the total number of false positives is reduced by 23.16%, and as a trade-off, the number of detected malicious samples decreases by 0.68%.

A Critical Cybersecurity Analysis and Future Research Directions for the Internet of Things: A Comprehensive Review

“…Large Payload Transfer Attack [65][66][67] The current utilization of the Internet of Things involves various applications that require large payload transfer, such as uploading medical data, transmitting audio data from medical devices, detecting vehicle crashes through digital audio, uploading images related to traffic crimes, and uploading binary files generated by industrial machines. Nevertheless, if such data transfers are initiated by devices controlled by hackers, they must be treated as anomalous and potentially malicious.…”

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

“…Large datasets with labeled data are necessary for ML-based systems, which are challenging and expensive to gather [183]; • Imbalanced Data: In cybersecurity, the number of normal instances (benign data) often outweighs the number of malicious instances (attack data), resulting in imbalanced datasets. This can lead to biased models and poorer performance in detecting rare cyber threats [184]; • Adversarial Attacks: Adversaries can attempt to manipulate ML models by crafting adversarial examples, which are carefully designed inputs to cause misclassification. Adversarial attacks can reduce the reliability and robustness of ML-based cybersecurity solutions [185].…”