On Designing Machine Learning Models for Malicious Network Traffic Classification

2019/07/10 by Talha Ongun, Timothy Sakharaov, Ongun, Talha +7 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Internet Traffic Analysis and Secure E-voting #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Network Security and Intrusion Detection

paper · pdf · doi:10.48550/arxiv.1907.04846

openalex publication_date 2019/07/10 · openalex created_date 2019/07/23 · openalex updated_date 2026/07/28

Abstract

Machine learning (ML) started to become widely deployed in cyber security settings for shortening the detection cycle of cyber attacks. To date, most ML-based systems are either proprietary or make specific choices of feature representations and machine learning models. The success of these techniques is difficult to assess as public benchmark datasets are currently unavailable. In this paper, we provide concrete guidelines and recommendations for using supervised ML in cyber security. As a case study, we consider the problem of botnet detection from network traffic data. Among our findings we highlight that: (1) feature representations should take into consideration attack characteristics; (2) ensemble models are well-suited to handle class imbalance; (3) the granularity of ground truth plays an important role in the success of these methods.

Cited by

• Botnet Detection Using Recurrent Variational Autoencoder

Related

• Cyber Attack Detection thanks to Machine Learning Algorithms
• Modern Cybersecurity Solution using Supervised Machine Learning
• Revisiting Network Traffic Analysis: Compatible network flows for ML models
• Towards Developing Network forensic mechanism for Botnet Activities in the IoT based on Machine Learning Techniques
• When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification