Machine Learning (In) Security: A Stream of Problems

Abstract

Machine Learning (ML) has been widely applied to cybersecurity and is considered state-of-the-art for solving many of the open issues in that field. However, it is very difficult to evaluate how good the produced solutions are, since the challenges faced in security may not appear in other areas. One of these challenges is the concept drift, which increases the existing arms race between attackers and defenders: malicious actors can always create novel threats to overcome the defense solutions, which may not consider them in some approaches. Due to this, it is essential to know how to properly build and evaluate an ML-based security solution. In this paper, we identify, detail, and discuss the main challenges in the correct application of ML techniques to cybersecurity data. We evaluate how concept drift, evolution, delayed labels, and adversarial ML impact the existing solutions. Moreover, we address how issues related to data collection affect the quality of the results presented in the security literature, showing that new strategies are needed to improve current solutions. Finally, we present how existing solutions may fail under certain circumstances, and propose mitigations to them, presenting a novel checklist to help the development of future ML solutions for cybersecurity.

A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks

“…While machine learning has shown its major potential in many different areas, several researchers have discussed pitfalls in the context of security systems [19,[25][26][27]. The authors of [19] argued that these pitfalls may be the reason why machine-learning-based systems are potentially still unsuited for practical deployment in security tasks.…”

“…Furthermore, there are multiple pitfalls when splitting the dataset into folds. Data leakage (temporal inconsistencies, data snooping) is, according to [26], one of them. For network data, leaks can occur if packets of the same attack or of a benign flow are split into different folds.…”

“…Class imbalance is an important problem frequently discussed in machine learning fields [19,26]. For network intrusion detection, this is especially relevant since the amount of malicious traffic is highly dependent on the attack type.…”

A Comparison of Neural Network-Based Intrusion Detection Against Signature-Based Detection in IoT Networks

“…While machine learning has shown its big potential in many different areas, several researchers are discussing pitfalls in the context of security systems [18,24,25]. The authors of [18] argue that these pitfalls may be the reason why learning-based systems are potentially still unsuited for practical deployment in security tasks.…”

“…Class imbalance is an important problem frequently discussed in machine learning fields [18,24]. For network intrusion detection this is especially relevant since the number of malicious traffic is highly dependent on the attack type.…”