A Review on Machine Learning Approaches for Network Malicious Behavior Detection in Emerging Technologies

Abstract

Network anomaly detection systems (NADSs) play a significant role in every network defense system as they detect and prevent malicious activities. Therefore, this paper offers an exhaustive overview of different aspects of anomaly-based network intrusion detection systems (NIDSs). Additionally, contemporary malicious activities in network systems and the important properties of intrusion detection systems are discussed as well. The present survey explains important phases of NADSs, such as pre-processing, feature extraction and malicious behavior detection and recognition. In addition, with regard to the detection and recognition phase, recent machine learning approaches including supervised, unsupervised, new deep and ensemble learning techniques have been comprehensively discussed; moreover, some details about currently available benchmark datasets for training and evaluating machine learning techniques are provided by the researchers. In the end, potential challenges together with some future directions for machine learning-based NADSs are specified.

Malicious behavior detection in cloud using self‐optimized dynamic kernel convolutional neural network

“…The feature values are translated to an acceptable confidence interval in this process 8,47 . The key benefit of this measure is that it eliminates dataset bias without changing the predictive properties of the features.…”

“…Different methods, such as Argus, Netmate, and others, are used to gather network traffic features. 8 The data in the UNSW-NB15 are divided into six feature categories to define user behavior: basic, flow, content, time created, and additional features. Utilizing the transactional flow identifiers and the transaction times, these features are derived.…”

“…The feature values are translated to an acceptable confidence interval in this process. 8,47 The key benefit of this measure is that it eliminates dataset bias without changing the predictive properties of the features. This analysis uses a min-max technique for normalization to accomplish the former, which is represented by the equation below:…”

“…Conventional security systems [6][7][8] mainly aim to secure the user's credentials while a malicious behavior recognition system aims to identify the abnormal behavior of the users after log-in. The conventional security techniques are often struggling with malware creators and detectors and the present intrusion system is not capable of identifying the novel malware created using new techniques such as deep learning, reverse engineering, etc.…”

A Network Data Reinforcement Method Based on the Multiclass Variational Autoencoder

“…It reduces the impact of network security events by monitoring abnormal behaviour in the network and linking with other security systems [2]. In recent years, the relevant technologies of the system have been deeply integrated with deep learning (DL), and a variety of network anomaly detection methods based on deep learning have been derived [3,4].…”