A hybrid machine learning approach for malicious behaviour detection and recognition in cloud computing

A Review on Machine Learning Approaches for Network Malicious Behavior Detection in Emerging Technologies

“…These malicious activities are either reported to the security administrator of system or gathered centrally by the security information event management (SIEM) system. The monitoring environments fall into two categories: host and network-based environments [ 14 ]. A host-based IDS (HIDS) monitors the activities of a host via gathering information about various processes that occur in a computer system.…”

“…A host-based IDS (HIDS) monitors the activities of a host via gathering information about various processes that occur in a computer system. Therefore, a sensor is deployed in the system to check the hosts and log the operating system activities, whereas a network-based IDS (NIDS) monitors network traffics to remotely identify anomalies spreading over a network connection [ 14 , 15 ].…”

“…ADSs (also called behavior-based detection system) first establish a normal profile and create a performance baseline under normal operating conditions. The detection system continuously monitors all input traffic and simultaneously compares against the predefined baseline, and any observation outside the baseline considered as an abnormal (malicious) behavior will send an alert to the security administration system [ 14 ]. Unlike MDSs and ADSs, which rely on host or network-specific characteristics, stateful protocol analysis (SPA) depend on vendor-developed universal profiles that determine how specific protocols are utilized.…”

“…Rootkit malware can be executed at various levels such as application programming interface (API) calls, at the user level or interfere with OS at the device level [ 27 ]. Analysis contains different types of port scanner attacks such as spam and .html file penetrations [ 14 ]. Ransomware attack is a malicious software from cryptovirology that threatens to reveal the victim’s sensitive information unless a ransom is paid [ 3 ].…”

“… Backdoors are the techniques that attacker uses to remotely gain access and control of the victim’s computer by normally responding to client applications. Many of these techniques utilize the IRC backbone and often obtain commands from IRC users’ chats [ 14 ]. Denial-of-service (DoS) is a malicious activity which tries to make a computer, OS or server unavailable to its client by temporarily or permanently interrupting the host services connected to the Internet [ 2 ].…”