Machine Learning Approaches in Cyber Security Analytics | springerprofessional.de

Springer Professional

nach oben

2020 | Buch

Kapitel lesen Erstes Kapitel lesen

Machine Learning Approaches in Cyber Security Analytics

verfasst von: Dr. Tony Thomas, Athira P. Vijayaraghavan, Dr. Sabu Emmanuel

Verlag: Springer Singapore

Enthalten in: Springer Professional "Wirtschaft+Technik" , Springer Professional "Technik" , Springer Professional "Wirtschaft"

Einloggen, um Zugang zu erhalten

Über dieses Buch

This book introduces various machine learning methods for cyber security analytics. With an overwhelming amount of data being generated and transferred over various networks, monitoring everything that is exchanged and identifying potential cyber threats and attacks poses a serious challenge for cyber experts. Further, as cyber attacks become more frequent and sophisticated, there is a requirement for machines to predict, detect, and identify them more rapidly. Machine learning offers various tools and techniques to automate and quickly predict, detect, and identify cyber attacks.

Anzeige

Inhaltsverzeichnis

Frontmatter

Chapter 1. Introduction

Abstract

Suppose that we want to build an automated malware detection mechanism for our smartphones. We want this detection mechanism to run in the background and alert the user whenever we install or run a malicious application. In this situation, a rule-based detection mechanism may not work as malware continuously evolve and a set of rules may not be sufficient to characterize an application as malware or goodware. Instead, we may have a detection mechanism which uses statistical models rather than deterministic rules.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 2. Introduction to Machine Learning

Abstract

Predictive modeling is a general concept where a model is built to make predictions. Machine learning algorithms are also predictive models that learn from a training dataset to make predictions. Predictive models can be built for classification or regression problems. Regression models explore relationships between variables and make predictions about continuous variables. Classification involves predicting discrete class labels for data points. For example, predicting whether an android application is a malware or goodware during a malware detection process is a classification task, whereas estimating the threat level of a system is a regression task.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 3. Machine Learning and Cybersecurity

Abstract

Machine learning (ML) may be defined as the ability of machines to learn without being explicitly programmed. Using mathematical techniques across cyberdata, ML algorithms can build models of behaviors and use those models as a basis for making predictions on newly input data. ML techniques can analyze threats and respond to attacks and security incidents quickly in an automated way.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 4. Support Vector Machines and Malware Detection

Abstract

In this chapter, we shall take a look at what support vector machine (SVM) is, how it works, and then get into the details of applying SVM in malware detection. SVM learning algorithm is a supervised machine learning technique used for both regression and classification problems. Regression models are used in predicting continuous values, and classification models are used in predicting which class a data point is part of. SVMs are mostly used for solving classification problems. At the end of this chapter, we also demonstrate the classification of malware from benign ones.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 5. Clustering and Malware Classification

Abstract

In the present time, where people maintain a close relationship with smartphones, it is easier for cybercriminals to gain user’s personal data by installing malware without the user’s knowledge or authorization. In such a situation where the user’s data and privacy are always at threat, it is necessary to build a resilient system so as to curb such attacks. The system should undergo a learning–decision-making process to early detect and defend malware attacks.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 6. Nearest Neighbor and Fingerprint Classification

Abstract

Nearest neighbors (NN) is a supervised machine learning technique. The basic principle of a NN algorithm is to find the neighbors located near to each data point in the test dataset and then assign it to a class that is most represented by the neighbors. NN classifier works by taking into consideration the maximum number of nearest neighbors belonging to the similar class.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 7. Dimensionality Reduction and Face Recognition

Abstract

Dimensionality reduction is used to reduce the number of features under consideration, where each feature is a dimension that partly represents the data objects. Dimensionality reduction methods make sure that all the relevant information remains intact while mapping data from a higher dimension to lower dimension.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 8. Neural Networks and Face Recognition

Abstract

Deep neural network also known as deep learning, an unsupervised machine learning technique, is an extension of neural networks with multiple hidden layers. Neural network has only a single hidden layer. The concept of deep learning was introduced to elevate the efficiency of neural nets by increasing the number of intermediate processing so as to increase the output prediction accuracy.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 9. Applications of Decision Trees

Abstract

Decision tree is a machine learning technique for solving both classification and regression problems. They help in identifying the relationship among data points in a dataset by constructing tree structures. These tree-like structures are used to make accurate predictions about unseen data. The dataset is split into multiple subsets, thereby resulting in each decision node branching to more decision nodes. The very first decision node from which the split begins is called the root node, and the final decision nodes which do not split further anymore are called the leaf nodes. Decision trees are constructed as a top-to-down structured model in the divide-and-conquer fashion.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Chapter 10. Adversarial Machine Learning in Cybersecurity

Abstract

Adversarial machine learning algorithms deal with adversarial sample generation which is creating false input data that are capable enough to fool any machine learning model. For instance, attributes of a goodware can be added to a malware executable to make the classifier identify a malicious sample as benign. As the name suggests, “adversary” means opponent or enemy. If you are thinking what an enemy has got to do in machine learning, this chapter will take you through how vulnerable machine learning models are and how easily they can misunderstand during the learning process. If any set of input data when given to a machine learning model gets misclassified, we call them as adversarial samples.

Tony Thomas, Athira P. Vijayaraghavan, Sabu Emmanuel

Backmatter

Titel: Machine Learning Approaches in Cyber Security Analytics
verfasst von: Dr. Tony Thomas
Athira P. Vijayaraghavan
Dr. Sabu Emmanuel
Copyright-Jahr: 2020
Verlag: Springer Singapore
Electronic ISBN: 978-981-15-1706-8
Print ISBN: 978-981-15-1705-1
DOI: https://doi.org/10.1007/978-981-15-1706-8

Premium Partner