A Systematic Review of Defensive and Offensive Cybersecurity with Machine Learning
Source abstract
Abstract
This is a systematic review of over one hundred research papers about machine learning methods applied to defensive and offensive cybersecurity. In contrast to previous reviews, which focused on several fragments of research topics in this area, this paper systematically and comprehensively combines domain knowledge into a single review. Ultimately, this paper seeks to provide a base for researchers that wish to delve into the field of machine learning for cybersecurity. Our findings identify the frequently used machine learning methods within supervised, unsupervised, and semi-supervised machine learning, the most useful data sets for evaluating intrusion detection methods within supervised learning, and methods from machine learning that have shown promise in tackling various threats in defensive and offensive cybersecurity.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Information and Cyber Security · Smart Grid Security and Resilience
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science and Engineering, College of Informatics, Korea University, Seoul 02841, Korea
Department of Computing Science, University of Alberta, Edmonton, AB T6G 2E8, Canada
References (100+)
Show source-provided references
1. Dua, S., and Du, X. (2016). Data Mining and Machine Learning in Cybersecurity, Auerbach Publications.10.1201/b10867 ↗
2. Triplett, C. (2020, August 18). Security is Only as Strong as the Weakest Link. Infosecurity Magazine, Available online: http://www.infosecurity-magazine.com/opinions/strong-weakest-link.
3. IEEE (2017). Artificial Intelligence and Machine Learning Applied to Cybersecurity, IEEE.
4. Nimon, H.I. (2013). Offensive and Defensive Security: Concepts, Planning, Operations, and Management, Xlibris Corporation.
5. The Introduction, Methods, Results, and Discussion (IMRAD) Structure: A Fifty-Year Survey
6. Dilek, S., Çakır, H., and Aydın, M. (2015). Applications of Artificial Intelligence Techniques to Combating Cyber Crimes: A Review. arXiv.10.5121/ijaia.2015.6102 ↗
7. Cyber Security Meets Artificial Intelligence: A Survey10.1631/FITEE.1800573 ↗
8. Charters, S., and Kitchenham, B.A. (2007). Guidelines for Performing Systematic Literature Reviews in Software Engineering, University of Durham. EBSE Technical Report.
9. Liberati, A., Altman, D.G., Tetzlaff, J., Mulrow, C., Gøtzsche, P.C., Ioannidis, J.P.A., Clarke, M., Devereaux, P.J., Kleijnen, J., and Moher, D. (2009). The PRISMA Statement for Reporting Systematic Reviews and Meta-Analyses of Studies That Evaluate Health Care Interventions: Explanation and Elaboration. PLoS Med., 6.10.2427/5768 ↗
10. Subgraph Robustness of Complex Networks under Attacks10.1109/TSMC.2017.2733545 ↗
11. Dominic, D.D., and Said, A.M. (2014, January 27–28). Network Anomaly Detection Approach based on Frequent Pattern Mining Technique. Proceedings of the International Conference on Computational Science and Technology (ICCST), Kota Kinabalu, Malaysia.10.1109/ICCST.2014.7045011 ↗
12. False Positive and False Negative Effects on Network Attacks10.1007/s10955-017-1923-7 ↗
13. Liang, J., Zhao, W., and Ye, W. (2017, January 26–29). Anomaly-Based Web Attack Detection: A Deep Learning Approach. Proceedings of the International Conference on Network, Communication and Computing (ICNCC), Silicon Valley, CA, USA.10.1145/3171592.3171594 ↗
14. Sallay, H., Bourouis, S., and Bouguila, N. (2015). Web Service Intrusion Detection Using a Probabilistic Framework. Progress in Systems Engineering Advances in Intelligent Systems and Computing, Springer International Publishing.10.1007/978-3-319-08422-0_24 ↗
15. Enache, A.-C., and Sgârciu, V. (2015, January 15–17). An Improved Bat Algorithm Driven by Support Vector Machines for Intrusion Detection. Proceedings of the Advances in Intelligent Systems and Computing International Joint Conference, Burgos, Spain.10.1007/978-3-319-19713-5_4 ↗
16. Yassin, W., Udzir, N.I., Abdullah, A., Abdullah, M.T., Zulzalil, H., and Muda, Z. (2014, January 26–27). Signature-Based Anomaly Intrusion Detection using Integrated Data Mining Classifiers. Proceedings of the International Symposium on Biometrics and Security Technologies (ISBAST), Kuala Lumpur, Malaysia.10.1109/ISBAST.2014.7013127 ↗
17. Alrawashdeh, K., and Purdy, C. (2016, January 18–20). Toward an Online Anomaly Intrusion Detection System Based on Deep Learning. Proceedings of the IEEE International Conference on Machine Learning and Applications (ICMLA), Anaheim, CA, USA.10.1109/ICMLA.2016.0040 ↗
18. Network Intrusion Detection using Equality Constrained Optimization-Based Extreme Learning Machines10.1016/j.knosys.2018.02.015 ↗
19. An Effective Combining Classifier Approach using Tree Algorithms for Network Intrusion Detection10.1007/s00521-016-2418-1 ↗
20. Goseva-Popstojanova, K., Anastasovski, G., and Pantev, R. (2012, January 27–30). Using Multiclass Machine Learning Methods to Classify Malicious Behaviors Aimed at Web Systems. Proceedings of the IEEE International Symposium on Software Reliability Engineering, Dallas, TX, USA.10.1109/ISSRE.2012.30 ↗
21. Alom, M.Z., and Taha, T.M. (2017, January 15–19). Network Intrusion Detection for Cyber Security using Unsupervised Deep Learning Approaches. Proceedings of the IEEE National Aerospace and Electronics Conference (NAECON), Dayton, OH, USA.10.1109/NAECON.2017.8268746 ↗
22. Adaptive Real-Time Anomaly Detection with Incremental Clustering10.1016/j.istr.2007.02.004 ↗
23. Baek, S., Kwon, D., Kim, J., Suh, S.C., Kim, H., and Kim, I. (2017, January 26–28). Unsupervised Labeling for Supervised Anomaly Detection in Enterprise and Cloud Networks. Proceedings of the IEEE International Conference on Cyber Security and Cloud Computing (CSCloud), New York, NY, USA.10.1109/CSCloud.2017.26 ↗
24. Cloppert, M. (2019, December 12). Security Intelligence: Attacking the Cyber Kill Chain; SANS Computer Forensics. Available online: http://www.sans.org/blog/security-intelligence-attacking-the-cyber-kill-chain/.
25. Predicting Adversarial Cyber-Intrusion Stages Using Autoregressive Neural Networks10.1109/MIS.2018.111145153 ↗
26. Early-Stage Malware Prediction using Recurrent Neural Networks10.1016/j.cose.2018.05.010 ↗
27. An Auto-Learning Approach for Network Intrusion Detection10.1007/s11235-017-0395-z ↗
28. Panda, M., Abraham, A., and Patra, M.R. (2010, January 23–25). Discriminative Multinomial Naïve Bayes for Network Intrusion Detection. Proceedings of the International Conference on Information Assurance and Security, Atlanta, GA, USA.10.1109/ISIAS.2010.5604193 ↗
29. A Hybrid Intrusion Detection System based on ABC-AFS Algorithm for Misuse and Anomaly Detection10.1016/j.comnet.2018.02.028 ↗
30. Teoh, T.T., Zhang, Y., Nguwi, Y.Y., Elovici, Y., and Ng, W.L. (2017, January 29–31). Analyst Intuition Inspired High Velocity Big Data Analysis using PCA Ranked Fuzzy k-Means Clustering with Multi-Layer Perceptron (MLP) to Obviate Cyber Security Risk. Proceedings of the International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery (ICNC-FSKD), Guilin, China.10.1109/FSKD.2017.8393038 ↗
31. Parveen, P., Lee, M., Henslee, A., Dugan, M., and Ford, B. (2018, January 7–9). Partition-Aware Scalable Outlier Detection Using Unsupervised Learning. Proceedings of the IEEE International Conference on Information Reuse and Integration (IRI), Salt Lake City, UT, USA.10.1109/IRI.2018.00035 ↗
32. Two-Tier Network Anomaly Detection Model: A Machine Learning Approach10.1007/s10844-015-0388-x ↗
33. Data Randomization and Cluster-Based Partitioning for Botnet Intrusion Detection10.1109/TCYB.2015.2490802 ↗
34. A Hybrid Technique using Binary Particle Swarm Optimization and Decision Tree Pruning for Network Intrusion Detection10.1007/s10586-017-0971-8 ↗
35. Botnet Detection based on Traffic Behavior Analysis and Flow Intervals10.1016/j.cose.2013.04.007 ↗
36. MARK-ELM: Application of a Novel Multiple Kernel Learning Framework for Improving the Robustness of Network Intrusion Detection10.1016/j.eswa.2014.12.040 ↗
37. Sequential Anomaly Detection based on Temporal-Difference Learning: Principles, Models and Case Studies10.1016/j.asoc.2009.10.003 ↗
38. Kaur, G., Malik, Y., Samuel, H., and Jaafar, F. (2018, January 28–30). Detecting Blind Cross-Site Scripting Attacks Using Machine Learning. Proceedings of the International Conference on Signal Processing and Machine Learning (SPML), Shanghai, China.10.1145/3297067.3297096 ↗
39. Dali, L., Mivule, K., and El-Sayed, H. (2017, January 7–8). A Heuristic Attack Detection Approach using the ‘Least Weighted’ Attributes for Cyber Security Data. Proceedings of the Intelligent Systems Conference (IntelliSys), London, UK.10.1109/IntelliSys.2017.8324260 ↗
40. An Evaluation of the Performance of Restricted Boltzmann Machines as a Model for Anomaly Network Intrusion Detection10.1016/j.comnet.2018.07.025 ↗
41. Hybrid Consensus for Averager–Copier–Voter Networks with Non-Rational Agents10.1016/j.chaos.2018.03.037 ↗
42. Siddiqui, S., Khan, M.S., and Ferens, K. (2017, January 14–19). Multiscale Hebbian Neural Network for Cyber Threat Detection. Proceedings of the International Joint Conference on Neural Networks (IJCNN), Anchorage, AK, USA.10.1109/IJCNN.2017.7966020 ↗
43. Contextual Information Fusion for Intrusion Detection: A Survey and Taxonomy10.1007/s10115-017-1027-3 ↗
44. Thompson, H., and Trilling, S. (2019, December 12). Cyber Security Predictions: 2019 and Beyond. Available online: https://www.symantec.com/blogs/feature-stories/cyber-security-predictions-2019-and-beyond.
45. D-SCIDS: Distributed Soft Computing Intrusion Detection System10.1016/j.jnca.2005.06.001 ↗
46. Hybrid Intrusion Detection Method to Increase Anomaly Detection by Using Data Mining Techniques10.14257/ijdta.2016.9.12.21 ↗
47. Ali, G.A., and Jantan, A. (2011). A New Approach Based on Honeybee to Improve Intrusion Detection System Using Neural Network and Bees Algorithm. Software Engineering and Computer Systems Communications in Computer and Information Science, Springer. [2011 ed.].10.1007/978-3-642-22203-0_65 ↗
48. Alqahtani, S.M., and John, R.A. (2016, January 6–9). Comparative Study of Different Fuzzy Classifiers for Cloud Intrusion Detection Systems Alerts. Proceedings of the IEEE Symposium Series on Computational Intelligence (SSCI), Athens, Greece.10.1109/SSCI.2016.7849911 ↗
49. Anindya, I.C., and Kantarcioglu, M. (2018, January 7–9). Adversarial Anomaly Detection Using Centroid-Based Clustering. Proceedings of the IEEE International Conference on Information Reuse and Integration (IRI), Salt Lake City, UT, USA.10.1109/IRI.2018.00009 ↗
50. Fuzziness Based Semi-Supervised Learning Approach for Intrusion Detection System10.1016/j.ins.2016.04.019 ↗
51. Balkanli, E., Alves, J., and Zincir-Heywood, A.N. (2014, January 9–12). Supervised Learning to Detect DDoS Attacks. Proceedings of the IEEE Symposium on Computational Intelligence in Cyber Security (CICS), Orlando, FL, USA.10.1109/CICYBS.2014.7013367 ↗
52. An Effective Intrusion Detection Framework based on MCLP/SVM Optimized by Time-Varying Chaos Particle Swarm Optimization10.1016/j.neucom.2016.03.031 ↗
53. Performance Evaluation of Intrusion Detection based on Machine Learning using Apache Spark10.1016/j.procs.2018.01.091 ↗
54. Boschetti, A., Salgarelli, L., Muelder, C., and Ma, K.-L. (2011, January 20). TVi: A Visual Querying System for Network Monitoring and Anomaly Detection. Proceedings of the International Symposium on Visualization for Cyber Security (VizSec), Pittsburgh, PA, USA.10.1145/2016904.2016905 ↗
55. Brahmi, I., Yahia, S.B., Aouadi, H., and Poncelet, P. (2012). Towards a Multiagent-Based Distributed Intrusion Detection System Using Data Mining Approaches. Lecture Notes in Computer Science Agents and Data Mining Interaction, Springer.10.1007/978-3-642-27609-5_12 ↗
56. Breier, J., and Branišová, J. (2015). Anomaly Detection from Log Files Using Data Mining Techniques. Lecture Notes in Electrical Engineering Information Science and Applications, Springer.10.1007/978-3-662-46578-3_53 ↗
57. Carvalho, M., and Perez, C. (2011, January 12–14). An Evolutionary Multi-Agent Approach to Anomaly Detection and Cyber Defense. Proceedings of the Workshop on Cyber Security and Information Intelligence Research (CSIIRW), Oak Ridge, TN, USA.10.1145/2179298.2179329 ↗
58. Chand, N., Mishra, P., Krishna, C.R., Pilli, E.S., and Govil, M.C. (October, January 30). A Comparative Analysis of SVM and its Stacking with Other Classification Algorithm for Intrusion Detection. Proceedings of the International Conference on Advances in Computing, Communication, & Automation (ICACCA), Dehradun, India.
59. Multilayer Hybrid Strategy for Phishing Email Zero-Day Filtering
60. A Study on Intrusion Detection using Neural Networks Trained with Evolutionary Algorithms10.1007/s00500-015-1967-z ↗
61. Data Preprocessing for Anomaly Based Network Intrusion Detection: A Review10.1016/j.cose.2011.05.008 ↗
62. Ding, J., Xu, S., Krämer, B., Bai, Y., Chen, H., and Zhang, J. (2004). Probabilistic Inference Strategy in Distributed Intrusion Detection Systems. Parallel and Distributed Processing and Applications Lecture Notes in Computer Science, Springer.10.1007/978-3-540-30566-8_97 ↗
63. Doroudian, M., Arastouie, N., Talebi, M., and Ghanbarian, A.R. (2015, January 15–17). Multilayered Database Intrusion Detection System for Detecting Malicious Behaviors in Big Data Transaction. Proceedings of the International Conference on Information Security and Cyber Forensics (InfoSec), Cape Town, South Africa.10.1109/InfoSec.2015.7435514 ↗
64. A Multi-Objective Evolutionary Fuzzy System to Obtain a Broad and Accurate Set of Solutions in Intrusion Detection Systems10.1007/s00500-017-2856-4 ↗
65. Survey of Uses of Evolutionary Computation Algorithms and Swarm Intelligence for Network Intrusion Detection10.1142/S146902681550025X ↗
66. Faisal, M.A., Aung, Z., Williams, J.R., and Sanchez, A. (2012). Securing Advanced Metering Infrastructure Using Intrusion Detection System with Data Stream Mining. Intelligence and Security Informatics Lecture Notes in Computer Science, Springer.10.1007/978-3-642-30428-6_8 ↗
67. Mining Network Data for Intrusion Detection through Combining SVMs with Ant Colony Networks10.1016/j.future.2013.06.027 ↗
68. Folino, G., Pizzuti, C., and Spezzano, G. (2005). GP Ensemble for Distributed Intrusion Detection Systems. Pattern Recognition and Data Mining Lecture Notes in Computer Science, Springer.10.1007/11551188_6 ↗
69. Intrusion Detection using Neural Based Hybrid Classification Methods10.1016/j.comnet.2010.12.008 ↗
70. Detecting Anomalous Behavior in Cloud Servers by Nested Arc Hidden SEMI-Markov Model with State Summarization10.1109/TBDATA.2017.2736555 ↗
71. Hassan, M.R. (2016). Intrusion Detection System Based on Cost Based Support Vector Machine. Recent Advances in Information and Communication Technology 2016 Advances in Intelligent Systems and Computing, Springer International Publishing.10.1007/978-3-319-40415-8_11 ↗
72. Helsloot, L.J., Tillem, G., and Erkin, Z. (2017, January 4–7). AHEad: Privacy-Preserving Online Behavioural Advertising using Homomorphic Encryption. Proceedings of the IEEE Workshop on Information Forensics and Security (WIFS), Rennes, France.10.1109/WIFS.2017.8267662 ↗
73. Hou, S., Saas, A., Chen, L., and Ye, Y. (2016, January 13–16). Deep4MalDroid: A Deep Learning Framework for Android Malware Detection Based on Linux Kernel System Call Graphs. Proceedings of the IEEE/WIC/ACM International Conference on Web Intelligence Workshops (WIW), Omaha, NE, USA.10.1109/WIW.2016.040 ↗
74. Hoz, E.d.l., Ortiz, A., Ortega, J., and De la Hoz, E. (2013). Network Anomaly Classification by Support Vector Classifiers Ensemble and Non-linear Projection Techniques. Lecture Notes in Computer Science Hybrid Artificial Intelligent Systems, Springer.
75. Idowu, R.K., Chandren, R., and Othman, Z.A. (2014, January 20–22). Advocating the Use of Fuzzy Reasoning Spiking Neural P System in Intrusion Detection. Proceedings of the Asian Conference on Membrane Computing (ACMC), Coimbatore, India.10.1109/ACMC.2014.7065804 ↗
76. Ioniţă, I., and Ioniţă, L. (2013, January 26–28). An Agent-Based Approach for Building an Intrusion Detection System. Proceedings of the International Conference on Networking in Education and Research (RoEduNet), Iasi, Romania.10.1109/RoEduNet.2013.6714184 ↗
77. A-GHSOM: An Adaptive Growing Hierarchical Self Organizing Map for Network Anomaly Detection10.1016/j.jpdc.2012.09.004 ↗
78. Efficient Privacy-Preserving Machine Learning in Hierarchical Distributed System10.1109/TNSE.2018.2859420 ↗
79. Jiang, J., Wang, Q., Shi, Z., Lv, B., and Qi, B. (2018, January 16–19). Rst-Rf: A Hybrid Model based on Rough Set Theory and Random Forest for Network Intrusion Detection. Proceedings of the International Conference on Cryptography, Security and Privacy (ICCSP), Guiyang, China.10.1145/3199478.3199489 ↗
80. A LogitBoost-Based Algorithm for Detecting Known and Unknown Web Attacks10.1109/ACCESS.2017.2766844 ↗
81. Khobzaoui, A., Mesfioui, M., Yousfate, A., and Bensaber, B.A. (2015). On Copulas-Based Classification Method for Intrusion Detection. IFIP Advances in Information and Communication Technology Computer Science and Its Applications, Springer International Publishing.10.1007/978-3-319-19578-0_32 ↗
82. Kianmehr, K. (2012, January 27–31). An Incremental Semi Rule-Based Learning Model for Cybersecurity in Cyberinfrastructures. Proceedings of the International Conference on Cyber Technology in Automation, Control, and Intelligent Systems (CYBER), Bangkok, Thailand.10.1109/CYBER.2012.6392538 ↗
83. A Network Intrusion Detection System based on a Hidden Naïve Bayes Multiclass Classifier10.1016/j.eswa.2012.07.009 ↗
84. Le, D.C., Zincir-Heywood, N., and Heywood, M.I. (2016, January 6–9). Data Analytics on Network Traffic Flows for Botnet Behaviour Detection. Proceedings of the IEEE Symposium Series on Computational Intelligence (SSCI), Athens, Greece.10.1109/SSCI.2016.7850078 ↗
85. MVPSys: Toward Practical Multi-View Based False Alarm Reduction System in Network Intrusion Detection10.1016/j.cose.2016.04.007 ↗
86. Liu, Y., and Zhang, X. (2016, January 8–12). Intrusion Detection Based on IDBM. Proceedings of the International Conference on Dependable, Autonomic and Secure Computing, Auckland, New Zealand.
87. Masduki, B.W., Ramli, K., Saputra, F.A., and Sugiarto, D. (2015, January 10–13). Study on Implementation of Machine Learning Methods Combination for Improving Attacks Detection Accuracy on Intrusion Detection System (IDS). Proceedings of the International Conference on Quality in Research (QiR), Lombok, Indonesia.10.1109/QiR.2015.7374895 ↗
88. Host-Based Intrusion Detection System for Secure Human-Centric Computing10.1007/s11227-015-1506-9 ↗
89. Mukkamala, S., and Sung, A.H. (2003, January 3–5). A Comparative Study of Techniques for Intrusion Detection. Proceedings of the IEEE International Conference on Tools with Artificial Intelligence (ITCAI), Sacramento, CA, USA.
90. Mukkamala, S., Sung, A.H., and Abraham, A. (2003). Intrusion Detection Using Ensemble of Soft Computing Paradigms. Intelligent Systems Design and Applications, Springer.10.1007/978-3-540-44999-7_23 ↗
91. Mukkamala, S., Sung, A.H., and Ribeiro, B.M. (2005). Model Selection for Kernel Based Intrusion Detection Systems. Adaptive and Natural Computing Algorithms, Springer.10.1007/3-211-27389-1_110 ↗
92. Mukkamala, S., Sung, A.H., Abraham, A., and Ramos, V. (2004). Intrusion Detection Systems Using Adaptive Regression Spines. Enterprise Information Systems, Springer.
93. Nguyen, H.H., Harbi, N., and Darmont, J. (2011, January 21–27). An Efficient Local Region and Clustering-Based Ensemble System for Intrusion Detection. Proceedings of the 15th Symposium on International Database Engineering & Applications (IDEAS′11), Lisbon, Portugal.10.1145/2076623.2076647 ↗
94. Probabilistic Models-Based Intrusion Detection using Sequence Characteristics in Control System Communication10.1007/s00521-015-1984-y ↗
95. Ou, X., Rajagopalan, S.R., and Sakthivelmurugan, S. (2009, January 7–11). An Empirical Approach to Modeling Uncertainty in Intrusion Analysis. Proceedings of the Annual Computer Security Applications Conference, Honolulu, HI, USA.10.1109/ACSAC.2009.53 ↗
96. Palenzuela, F., Shaffer, M., Ennis, M., Gorski, J., McGrew, D., Yowler, D., White, D., Holbrook, L., Yakopcic, C., and Taha, T.M. (2016, January 26–29). Multilayer Perceptron Algorithms for Cyberattack Detection. Proceedings of the IEEE National Aerospace and Electronics Conference (NAECON) and Ohio Innovation Summit (OIS), Dayton, OH, USA.10.1109/NAECON.2016.7856806 ↗
97. Pathak, V., and Ananthanarayana, V.S. (2012, January 25–27). A Novel Multi-Threaded K-Means Clustering Approach for Intrusion Detection. Proceedings of the IEEE International Conference on Computer Science and Automation Engineering, Beijing, China.10.1109/ICSESS.2012.6269577 ↗
98. Qin, H., Riehle, K., and Zhao, H. (2017, January 11–14). Using Google Analytics to Support Cybersecurity Forensics. Proceedings of the IEEE International Conference on Big Data (Big Data), Boston, MA, USA.10.1109/BigData.2017.8258385 ↗
99. Adaptive and Online Network Intrusion Detection System using Clustering and Extreme Learning Machines10.1016/j.jfranklin.2017.06.006 ↗
100. Ruiz-Agundez, I., Penya, Y.K., and Bringas, P.G. (2010, January 13–15). Optimal Bayesian Network Design for Efficient Intrusion Detection. Proceedings of the International Conference on Human System Interaction, Rzeszow, Poland.10.1109/HSI.2010.5514530 ↗