A Survey on Machine Learning Techniques for Cyber Security in the Last Decade

Abstract

Pervasive growth and usage of the Internet and mobile applications have expanded cyberspace. The cyberspace has become more vulnerable to automated and prolonged cyberattacks. Cyber security techniques provide enhancements in security measures to detect and react against cyberattacks. The previously used security systems are no longer sufficient because cybercriminals are smart enough to evade conventional security systems. Conventional security systems lack efficiency in detecting previously unseen and polymorphic security attacks. Machine learning (ML) techniques are playing a vital role in numerous applications of cyber security. However, despite the ongoing success, there are significant challenges in ensuring the trustworthiness of ML systems. There are incentivized malicious adversaries present in the cyberspace that are willing to game and exploit such ML vulnerabilities. This paper aims to provide a comprehensive overview of the challenges that ML techniques face in protecting cyberspace against attacks, by presenting a literature on ML techniques for cyber security including intrusion detection, spam detection, and malware detection on computer networks and mobile networks in the last decade. It also provides brief descriptions of each ML method, frequently used security datasets, essential ML tools, and evaluation metrics to evaluate a classification model. It finally discusses the challenges of using ML techniques in cyber security. This paper provides the latest extensive bibliography and the current trends of ML in cyber security.

A Comparative Performance Analysis of Data Resampling Methods on Imbalance Medical Data

“…If the majority of its neighbours classify an instance incorrectly, that instance is discarded [30]. 3) Cluster Centroids: This method performs k-means an d replaces the majority class samples with their respective cluster centroids to reduce the n u mb er of samples [31]. 4) Edited Nearest Neighbors (ENN): Each instance is tested using k-NN with the rest of the samples in t h is method.…”

Unsupervised Algorithms to Detect Zero-Day Attacks: Strategy and Application

“…Supervised algorithms learn a model allowing to classify any new observation (a data point) as either collected when a system is targeted by a malicious attack, or during normal operations. For example, the literature reports on the successful usage of Random Forests [44], Support Vector Machines [54], [82], Convolutional Deep Neural Networks [38], [55], [71] for the detection of attacks through the analysis of network traffic, assuming that those attacks are known at training time by the supervised ML algorithms.…”

Detecting Temporal Attacks: An Intrusion Detection System for Train Communication Ethernet Based on Dynamic Temporal Convolutional Network

“…e huge volume of network data has made intrusion detection issues amenable to machine learning (ML) methods, which have been successfully applied in natural language processing [8], recommendation system [9], etc. ML-based IDS has attracted much interest from researchers over the last decade [10][11][12]. ML-based IDS could be roughly divided into pattern recognition issues and anomaly detection issues despite its fuzzy boundary, which means that it overlaps with anomaly-based IDS to a large extent.…”