scispace - formally typeset
Journal ArticleDOI

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

TLDR
The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/ DM for cyber security is presented, and some recommendations on when to use a given method are provided.
Abstract
This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.

read more

Citations
More filters
Posted Content

Sequence Aggregation Rules for Anomaly Detection in Computer Network Traffic.

TL;DR: It is concluded that the frequency-based model tends to perform as well as or better than the LSTM models for the tasks at hand, with a few notable exceptions.
Journal ArticleDOI

Robust deep auto-encoding Gaussian process regression for unsupervised anomaly detection

TL;DR: A novel hybrid unsupervised AD method is proposed that first integrates convolutional auto-encoder and Gaussian process regression to extract features and to remove anomalies from noisy data as well, which behaves more effectively at modeling high-dimension data and more robust to variation of the anomaly rate in dataset.
Posted Content

An Adversarial Approach for Explainable AI in Intrusion Detection Systems

TL;DR: An approach to generate explanations for incorrect classifications made by data-driven Intrusion Detection Systems (IDSs) by finding the minimum modifications required to correctly classify a given set of misclassified samples.
Journal ArticleDOI

Distance Measurement Methods for Improved Insider Threat Detection

TL;DR: This work builds on a published method of detecting insider threats and applies Hidden Markov method on a CERT data set and analyses a number of distance vector methods in order to detect changes of behaviour, which are shown to have success in determining different insider threats.
Journal ArticleDOI

Automatic Multi-task Learning System for Abnormal Network Traffic Detection

TL;DR: This study proposes a novel multi-task learning system based on convolutional neural network, which can simultaneously solve the tasks of malware detection, VPN-capsulation recognition and Trojan classification, and finds a synergy among all these tasks and achieves the state-of-the-art output.
References
More filters
Journal ArticleDOI

Random Forests

TL;DR: Internal estimates monitor error, strength, and correlation and these are used to show the response to increasing the number of features used in the forest, and are also applicable to regression.
Book

Fuzzy sets

TL;DR: A separation theorem for convex fuzzy sets is proved without requiring that the fuzzy sets be disjoint.
Book

The Nature of Statistical Learning Theory

TL;DR: Setting of the learning problem consistency of learning processes bounds on the rate of convergence ofLearning processes controlling the generalization ability of learning process constructing learning algorithms what is important in learning theory?
Journal ArticleDOI

Collective dynamics of small-world networks

TL;DR: Simple models of networks that can be tuned through this middle ground: regular networks ‘rewired’ to introduce increasing amounts of disorder are explored, finding that these systems can be highly clustered, like regular lattices, yet have small characteristic path lengths, like random graphs.
Related Papers (5)