Machine Learningand Deep Learning
Machine Learningand Deep Learning
net/publication/340098454
CITATIONS READS
105 11,616
4 authors:
All content following this page was uploaded by Said A. Salloum on 08 March 2021.
1 Introduction
This paper takes into view the cyber security applications and presents the outcomes of a
literature survey of machine learning (ML), deep learning (DL), and data mining
(DM) methods. In addition, it explains the (ML/DL)/DM methods and their applications
to cyber intrusion detection issues. Besides providing a set of comparison criteria for
(ML/DL)/DM methods, the paper analyzes the complexity of different (ML/DL)/DM
algorithms. Subsequently, best methods and a set of recommendations are given subject
to the attributes of the cyber problem. The set of processes and technologies that are
formulated for the prevention of unauthorized access, attack, change, or destruction of
networks, computers, data and programs is referred to as the cyber security [1]. The
network security systems and computer (host) security systems basically make up the
cyber security systems. At least, a single antivirus software, firewall and an intrusion
detection system (IDS) must be included in each of these entities [1]. In addition to
identification, IDSs do discover and determine the unauthorized use, alteration, dupli-
cation and damage of information systems [2]. The internal intrusions (intra-organization
attacks) and external intrusions (inter-organization attacks) are known as the security
breaches. In sensing security threats, the artificial intelligent and machine learning based
methodologies have become an essential part of our lives because of the rise in the ratio of
© Springer Nature Switzerland AG 2020
A.-E. Hassanien et al. (Eds.): AICV 2020, AISC 1153, pp. 50–57, 2020.
https://doi.org/10.1007/978-3-030-44289-7_5
Machine Learning and Deep Learning Techniques for Cybersecurity 51
cyber-attacks [3]. The standards of security play an important role in the provision of the
best security applications keeping in view their implementation and security require-
ments. They are vital for cyber security research from this perspective, such as intrusion
detection system. While machine and deep learning algorithms and particular datasets can
be corroborated through some research studies, literature doesn’t contain much content
on the (ML/DL)/DM techniques for cyber security and security-related datasets.
While concentrating on the (ML/DL)/DM methods and their descriptions, the
(ML/DL)/DM techniques are focused by this survey paper aiming at cyber security.
Besides publication of several reviews [1, 3–7], many papers containing these methods
have also been published [8, 9]. Compared to earlier reviews, the publications fulfilling
certain criteria will be the major emphasis of our paper. The techniques, such as:
“machine learning” or “deep learning” and cybersecurity along with “data mining”
were used to perform Google Scholar queries. The highly cited papers containing well-
known techniques were among the main concerns. Nevertheless, there was a realization
that novel and innovative techniques would possibly be ignored; therefore a few of
these articles were also selected. By and large, selection of papers was done with a view
to incorporate at least one and preferably a few representative papers about each of the
(ML/DL)/DM categories. The remainder of this paper is organized as follows: Sect. 2
offered a summary of some relevant literature. Section 4 overviews different (ML/DL)/
DM methods used in cyber security. Section 4 discusses cybersecurity datasets for
(ML/DL)/DM and Sect. 5 concludes the paper with a brief summary of the paper’s key
points and other closing remarks.
2 Literature Review
4 Cybersecurity Datasets
Currently, data is prepared by various research groups both for their own analysis and
for provision to community repositories [3]. Using machine learning and artificial
intelligent research, the present security-related datasets are explained by this section.
this dataset is also considered as benchmark data. One of the renowned data sets to
assess performance of anomaly detection methods is none other than the KDD’99 [3].
Presently, KDD dataset is being used by various researchers [38, 44–46]
One of the key issues for national and international security is the safety of computer
systems from cyber-attacks. With numerous machine learning techniques, a survey on
security concerns has been presented in this article. Several datasets have been
employed to conduct various researches. In addition, a significant role in protection
of computer systems is performed by machine learning and artificial intelligence.
Machine Learning and Deep Learning Techniques for Cybersecurity 55
The literature review of ML/DL and DM methods used for cyber is explained by this
paper. The example papers explaining various ML/DL and DM techniques in the cyber
domain were carefully found and widespread classes of various datasets have been
defined along with their advantages and disadvantages. We aim to generate new dataset
in the future, which will be open to all.
References
1. Buczak, A.L., Guven, E.: A survey of data mining and machine learning methods for cyber
security intrusion detection. IEEE Commun. Surv. Tutor. 18(2), 1153–1176 (2015)
2. Mukkamala, S., Sung, A., Abraham, A.: Cyber security challenges: designing efficient
intrusion detection systems and antivirus tools. In: Vemuri, V.R. (ed.) Enhancing Computer
Security with Smart Technology 2006, pp. 125–163 (2005)
3. Yavanoglu, O., Aydos, M.: A review on cyber security datasets for machine learning
algorithms. In: 2017 IEEE International Conference on Big Data (Big Data), pp. 2186–2193
(2017)
4. da Costa, K.A.P., Papa, J.P., Lisboa, C.O., Munoz, R., de Albuquerque, V.H.C.: Internet of
Things: a survey on machine learning-based intrusion detection approaches. Comput. Netw.
151, 147–157 (2019)
5. Liu, Q., Li, P., Zhao, W., Cai, W., Yu, S., Leung, V.C.M.: A survey on security threats and
defensive techniques of machine learning: a data driven view. IEEE Access 6, 12103–12117
(2018)
6. Xin, Y., et al.: Machine learning and deep learning methods for cybersecurity. IEEE Access
6, 35365–35381 (2018)
7. Dua, S., Du, X.: Data Mining and Machine Learning in Cybersecurity. Auerbach
Publications (2016)
8. Yin, C., Zhu, Y., Fei, J., He, X.: A deep learning approach for intrusion detection using
recurrent neural networks. IEEE Access 5, 21954–21961 (2017)
9. Xiao, L., Wan, X., Lu, X., Zhang, Y., Wu, D.: IoT security techniques based on machine
learning (2018). arXiv Prepr. arXiv:1801.06275
10. Jordan, M.I., Mitchell, T.M.: Machine learning: Trends, perspectives, and prospects. Science
(80-.) 349(6245), 255–260 (2015)
11. Fraley, J.B., Cannady, J.: The promise of machine learning in cybersecurity. SoutheastCon
2017, 1–6 (2017)
12. Alazab, M., Tang, M.: Deep Learning Applications for Cyber Security. Springer, Heidelberg
(2019)
13. Li, J.: Cyber security meets artificial intelligence: a survey. Front. Inf. Technol. Electron.
Eng. 19(12), 1462–1474 (2018)
14. Jones, C.L., Bridges, R.A., Huffer, K.M.T., Goodall, J.R.: Towards a relation extraction
framework for cyber-security concepts. In: Proceedings of the 10th Annual Cyber and
Information Security Research Conference, p. 11 (2015)
15. McNeil, N., Bridges, R.A., Iannacone, M.D., Czejdo, B., Perez, N., Goodall, J.R.: Pace:
pattern accurate computationally efficient bootstrapping for timely discovery of cyber-
security concepts. In: 2013 12th International Conference on Machine Learning and
Applications, vol. 2, pp. 60–65 (2013)
16. Zhang, Q., Man, D., Yang, W.: Using HMM for intent recognition in cyber security situation
awareness. In: 2009 Second International Symposium on Knowledge Acquisition and
Modeling, vol. 2, pp. 166–169 (2009)
56 S. A. Salloum et al.
17. Bonaci, T., Herron, J., Yusuf, T., Yan, J., Kohno, T., Chizeck, H.J.: To make a robot secure:
an experimental analysis of cyber security threats against teleoperated surgical robots (2015).
arXiv Prepr. arXiv:1504.04339
18. Hacioglu, U., Sevgilioglu, G.: The evolving role of automated systems and its cyber-security
issue for global business operations in Industry 4.0. Int. J. Bus. Ecosyst. Strategy 1(1), 1–11
(2019)
19. Alhashmi, S.F.S., Salloum, S.A., Abdallah, S.: Critical success factors for implementing
artificial intelligence (AI) projects in Dubai government United Arab Emirates (UAE) health
sector: applying the extended technology acceptance model (TAM). In: International
Conference on Advanced Intelligent Systems and Informatics, pp. 393–405 (2019)
20. Darwish, A., Ezzat, D., Hassanien, A.E.: An optimized model based on convolutional neural
networks and orthogonal learning particle swarm optimization algorithm for plant diseases
diagnosis. Swarm Evol. Comput. 52, 100616 (2020)
21. Abdelghafar, S., Darwish, A., Hassanien, A.E.: Intelligent health monitoring systems for
space missions based on data mining techniques. In: Machine Learning and Data Mining in
Aerospace Technology, pp. 65–78. Springer (2020)
22. Elsayad, D., Ali, A., Shedeed, H.A., Tolba, M.F.: PAGeneRN: parallel architecture for gene
regulatory network. In: Data Analytics in Medicine: Concepts, Methodologies, Tools, and
Applications, pp. 1052–1075. IGI Global (2020)
23. Pacheco, A.G.C., Ali, A.-R., Trappenberg, T.: Skin cancer detection based on deep learning
and entropy to detect outlier samples (2019). arXiv Prepr. arXiv:1909.04525
24. Salloum, S.A., Al-Emran, M., Monem, A., Shaalan, K.: A survey of text mining in social
media: facebook and twitter perspectives. Adv. Sci. Technol. Eng. Syst. J. 2(1), 127–133
(2017)
25. Alomari, K.M., AlHamad, A.Q., Salloum, S.: Prediction of the digital game rating systems
based on the ESRB. Opción 35(19), 1368–1393 (2019)
26. Salloum, S.A., Al-Emran, M., Shaalan, K.: Mining social media text: extracting knowledge
from facebook. Int. J. Comput. Digit. Syst. 6(2), 73–81 (2017)
27. Salloum, S.A., Al-Emran, M., Abdallah, S., Shaalan, K.: Analyzing the Arab Gulf
newspapers using text mining techniques. In: International Conference on Advanced
Intelligent Systems and Informatics, pp. 396–405 (2017)
28. Salloum, S.A., Al-Emran, M., Shaalan, K.: Mining text in news channels: a case study from
facebook. Int. J. Inf. Technol. Lang. Stud. 1(1), 1–9 (2017)
29. Salloum, S.A., AlHamad, A.Q., Al-Emran, M., Shaalan, K.: A survey of Arabic text mining,
vol. 740 (2018)
30. Salloum, S.A., Mhamdi, C., Al-Emran, M., Shaalan, K.: Analysis and classification of
Arabic newspapers’ facebook pages using text mining techniques. Int. J. Inf. Technol. Lang.
Stud. 1(2), 8–17 (2017)
31. Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., Mané, D.: Concrete
problems in AI safety (2016). arXiv Prepr. arXiv:1606.06565
32. Papernot, N., McDaniel, P., Sinha, A., Wellman, M.: Towards the science of security and
privacy in machine learning (2016). arXiv Prepr. arXiv:1611.03814
33. Feily, M., Shahrestani, A., Ramadass, S.: A survey of botnet and botnet detection. In: 2009
Third International Conference on Emerging Security Information, Systems and Technolo-
gies, pp. 268–273 (2009)
34. Ben Salem, M., Hershkop, S., Stolfo, S.J.: A survey of insider attack detection research. In:
Insider Attack and Cyber Security, pp. 69–90. Springer (2008)
35. Bhamare, D., Salman, T., Samaka, M., Erbad, A., Jain, R.: Feasibility of supervised machine
learning for cloud security. In: 2016 International Conference on Information Science and
Security (ICISS), pp. 1–5 (2016)
Machine Learning and Deep Learning Techniques for Cybersecurity 57
36. Gallagher, B., Eliassi-Rad, T.: Classification of http attacks: a study on the ECML/PKDD
2007 discovery challenge. Lawrence Livermore National Lab. (LLNL), Livermore, CA
(United States) (2009)
37. Haddadi, F., Le Cong, D., Porter, L., Zincir-Heywood, A.N.: On the effectiveness of
different botnet detection approaches. In: International Conference on Information Security
Practice and Experience, pp. 121–135 (2015)
38. Xie, M., Hu, J., Slay, J.: Evaluating host-based anomaly detection systems: application of the
one-class SVM algorithm to ADFA-LD. In: 2014 11th International Conference on Fuzzy
Systems and Knowledge Discovery (FSKD), pp. 978–982 (2014)
39. Kato, K., Klyuev, V.: An intelligent DDoS attack detection system using packet analysis and
support vector machine. In: IJICR, pp. 478–485 (2014)
40. Yusof, A.R., Udzir, N.I., Selamat, A.: An evaluation on KNN-SVM algorithm for detection
and prediction of DDoS attack. In: International Conference on Industrial, Engineering and
Other Applications of Applied Intelligent Systems, pp. 95–102 (2016)
41. Hasan, M.A.M., Nasser, M., Ahmad, S., Molla, K.I.: Feature selection for intrusion detection
using random forest. J. Inf. Secur. 7(03), 129 (2016)
42. Javaid, A., Niyaz, Q., Sun, W., Alam, M.: A deep learning approach for network intrusion
detection system. In: Proceedings of the 9th EAI International Conference on Bio-inspired
Information and Communications Technologies (formerly BIONETICS), pp. 21–26 (2016)
43. Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., Ghogho, M.: Deep learning approach
for network intrusion detection in software defined networking. In: 2016 International
Conference on Wireless Networks and Mobile Communications (WINCOM), pp. 258–263
(2016)
44. Chowdhury, S., et al.: Botnet detection using graph-based feature clustering. J. Big Data 4
(1), 14 (2017)
45. Neethu, B.: Adaptive intrusion detection using machine learning. Int. J. Comput. Sci. Netw.
Secur. 13(3), 118 (2013)
46. Kozik, R., Choraś, M., Renk, R., Hołubowicz, W.: A proposal of algorithm for web
applications cyber attack detection. In: IFIP International Conference on Computer
Information Systems and Industrial Management, pp. 680–687 (2015)
47. Lippmann, R., Haines, J.W., Fried, D.J., Korba, J., Das, K.: The 1999 DARPA off-line
intrusion detection evaluation. Comput. Netw. 34(4), 579–595 (2000)
48. Saad, S., et al.: Detecting P2P botnets through network behavior analysis and machine
learning. In: 2011 Ninth Annual International Conference on Privacy, Security and Trust,
pp. 174–180 (2011)
49. Torrano-Gimenez, C., Perez-Villegas, A., Alvarez, G.: A self-learning anomaly-based web
application firewall. In: Computational Intelligence in Security for Information Systems,
pp. 85–92. Springer (2009)
50. Torrano-Gimenez, C., Pérez-Villegas, A., Álvarez, G., Fernández-Medina, E., Malek, M.,
Hernando, J.: An anomaly-based web application firewall. In: SECRYPT, pp. 23–28 (2009)
51. Nguyen, H.T., Torrano-Gimenez, C., Alvarez, G., Petrović, S., Franke, K.: Application of
the generic feature selection measure in detection of web attacks. In: Computational
Intelligence in Security for Information Systems, pp. 25–32. Springer (2011)
52. Hoque, N., Bhattacharyya, D.K., Kalita, J.K.: A novel measure for low-rate and high-rate
DDoS attack detection using multivariate data analysis. In: 2016 8th International
Conference on Communication Systems and Networks (COMSNETS), pp. 1–2 (2016)
53. Torrano-Giménez, C., Perez-Villegas, A., Alvarez Maranón, G.: An anomaly-based
approach for intrusion detection in web traffic (2010)