Data Mining and Machine Learning in Cybersecurity - Book by Sumeet Dua and Xian Du

Data Mining and
Machine Learning
in Cybersecurity
Sumeet Dua and Xian Du
Lffi) CRC Press
\ V J Taylor & Francis Group
Boca Raton London New York
CRC Press is an imprint of the
Taylor & Francis Croup, an i n f o r m a business
A N AUERBACH BOOK

Contents
List of Figures xi
List of Tables xv
Preface xvii
Authors xxi
1 Introduction 1
1.1 Cybersecurity 2
1.2 Data Mining 5
1.3 Machine Learning 7
1.4 Review of Cybersecurity Solutions 8
1.4.1 Proactive Security Solutions 8
1.4.2 Reactive Security Solutions 9
1.4.2.1 Misuse/Signature Detection 10
1.4.2.2 Anomaly Detection 10
1.4.2.3 Hybrid Detection 13
1.4.2.4 Scan Detection 13
1.4.2.5 Profiling Modules 13
1.5 Summary 14
1.6 Further Reading 15
References 16
2 Classical Machine-Learning Paradigms for Data Mining 2 3
2.1 Machine Learning 24
2.1.1 Fundamentals of Supervised Machine-Learning
Methods 24
2.1.1.1 Association Rule Classification 24
2.1.1.2 Artificial Neural Network 25

vi • Contents
2.1.1.3 Support Vector Machines 27
2.1.1.4 Decision Trees 29
2.1.1.5 Bayesian Network 30
2.1.1.6 Hidden Markov Model 31
2.1.1.7 Kaiman Filter 34
2.1.1.8 Bootstrap, Bagging, and AdaBoost 34
2.1.1.9 Random Forest 37
2.1.2 Popular Unsupervised Machine-Learning Methods 38
2.1.2.1 £-Means Clustering 38
2.1.2.2 Expectation Maximum 38
2.1.2.3 ^-Nearest Neighbor 40
2.1.2.4 S O M A N N 41
2.1.2.5 Principal Components Analysis 41
2.1.2.6 Subspace Clustering 43
2.2 Improvements on Machine-Learning Methods 44
2.2.1 New Machine-Learning Algorithms 44
2.2.2 Resampling 46
2.2.3 Feature Selection Methods 46
2.2.4 Evaluation Methods 47
2.2.5 Cross Validation 49
2.3 Challenges 50
2.3.1 Challenges in Data Mining 50
2.3.1.1 Modeling Large-Scale Networks 50
2.3.1.2 Discovery of Threats 50
2.3.1.3 Network Dynamics and Cyber Attacks 51
2.3.1.4 Privacy Preservation in Data Mining 51
2.3.2 Challenges in Machine Learning (Supervised
Learning and Unsupervised Learning) 51
2.3.2.1 Online Learning Methods for Dynamic
Modeling of Network Data 52
2.3.2.2 Modeling Data with Skewed Class
Distributions to Handle Rare Event Detection 52
2.3.2.3 Feature Extraction for Data with Evolving
Characteristics 53
2.4 Research Directions 53
2.4.1 Understanding the Fundamental Problems
of Machine-Learning Methods in Cybersecurity 54
2.4.2 Incremental Learning in Cyberinfrastructures 54
2.4.3 Feature Selection/Extraction for Data with Evolving
Characteristics 54
2.4.4 Privacy-Preserving Data Mining 55
2.5 Summary 55
References 55