Citation:

Ashok Choppadandi, Jagbir Kaur, Pradeep Kumar Chenchala, Akshay Agarwal, Varun Nakra, Pandi Kirupa Gopalakrishna Pandian, 2021. "Anomaly Detection in Cybersecurity: Leveraging Machine Learning Algorithms" ESP Journal of Engineering & Technology Advancements  1(2): 34-41.

Abstract:

Aim: Detecting anomalies is turning to be one of the focal areas in cyber defence system in the presence of numerous types of cyber threats. The research looks at multi-layer application of machine learning regimes in cyber security applications and particularly focuses on the anomaly detection which enables the computer to develop and respond to new threats, provide predictive and monitoring services.

Method: On the one hand, this work uses reliable methods like literature review and empirical analysis to scrutinize the effectiveness of ML methods such as anomaly detection in the proposed application area. Such unsupervised techniques for instance Random Forests, Support Vector Machines (SVMs) and Neural networks may be applicable to organized sample sets with labelled information. The algorithms capable of operating without a supervisor like Isolation Forest, SVM (Single Class) and Autoencoder are employed when labelled data is not available. In addition to the use of supervised approach, seeded semi-supervised and ensemble methods are going to be further explored to boost algorithms effectiveness (Jeffrey et al., 2021).

Results: The experimental results from the benchmark datasets, e.g. NSL-KDD and UNSW-NB15, illustrated the power of ML algorithms in the process of detecting anomalous traffic data. Random Forests have been best performing, having an accuracy of 92.7% and an AUC-ROC of 0.98 on NSL-KDD dataset. On this, unsupervised Isolation Forests did 91.2% Accuracy and 0.96 AUC-ROC values for UNSW-NB15 dataset. Lastly, aggregation algorithms combining the existing many algorithms also contributed to the final accuracy of 94.3% and AUC-ROC of 0.99 on the UNSW-NB15 dataset. In spite of these, problems such as data quality, feature engineering, algorithm selection, and explainability are still with us.

Conclusion: The study has demonstrated that ML-based anomaly detection may be a great technique for reinforcing cybersecurity practices. ML algorithms supersede the rule-based approach in their responsiveness to new cyber threats and in the identification of complex patterns. Ensemble and hybrid methods, which combine several algorithms or use domain knowledge, are seen as a hope for the real-world deployment of recognition security methods in practice.

References:

[1] Akalank, S., & Kodogiannis, V. (2020). Anomaly detection in cybersecurity using machine learning techniques. Journal of Cyber Security Technology, 4(4), 173-192. https://doi.org/10.1080/23742917.2020.1803720
[2] Alauthman, M., Aslam, N., Al-Dossari, H., Alqarni, A., & Rizwan, A. (2020). A novel reinforced kernel extreme learning machine model for IoT big data in cybersecurity and intrusion detection systems. IEEE Access, 8, 86537-86554. https://doi.org/10.1109/ACCESS.2020.2992785
[3] Chen, S., Wang, G., & Ouyang, D. (2019). Anomaly detection and key data exploration in cybersecurity: Analytical experiments and data cloud. IEEE Access, 7, 119662-119672. https://doi.org/10.1109/ACCESS.2019.2937337
[4] Diro, A. A., & Chilamkurti, N. (2018). Distributed attack detection scheme using deep learning approach for Internet of Things. Future Generation Computer Systems, 82, 761-768. https://doi.org/10.1016/j.future.2017.08.043
[5] Finlay, S. (2014). Predictive analytics, data mining and big data: Myths, misconceptions and methods. Palgrave Macmillan.
[6] Friedberg, I., McLaughlin, K., Smith, P., Laverty, D., & Sezer, S. (2020). HIML: A DARPA Cyber Assured System towards Explainable Anomaly Detection. IEEE Transactions on Information Forensics and Security, 15, 2304-2319. https://doi.org/10.1109/TIFS.2019.2958610
[7] Hindy, H., Brosseau, C., Bayne, E., Seeam, A., Tarray, R., Akkari, N., & Hamu, M. (2020). A taxonomy and survey of intrusion detection system design techniques, network threats and datasets. IEEE Communications Surveys & Tutorials, 22(4), 2508-2543. https://doi.org/10.1109/COMST.2020.3013195
[8] Hu, W., Tan, Y., Liu, M., & Yan, X. (2019). Intrusion detection system based on machine learning: An overview. IOP Conference Series: Materials Science and Engineering, 646(1), 012029. https://doi.org/10.1088/1757-899X/646/1/012029
[9] Khosla, A., & Gupta, B. B. (2020). Cybersecurity and data science techniques for network intrusion detection systems. CRC Press.
[10] Kim, J., Kim, J., Thu, H. L. T., & Kim, H. (2016). Long short term memory recurrent neural network classifier for intrusion detection. 2016 International Conference on Platform Technology and Service (PlatCon), 1-5. https://doi.org/10.1109/PlatCon.2016.7456805
[11] Kirubavathi, G., & Anitha, R. (2018). Structural analysis of machine learning anomaly detection techniques for Cybersecurity. In R. M. Sundaram, & R. Sakuntharaj (Eds.), Machine Learning and Internet of Things: Recent Advances and Applications (pp. 125-149). CRC Press.
[12] Kwon, D., Kim, H., Kim, J., Suh, S. C., Kim, I., & Kim, K. J. (2019). A survey of deep learning-based network anomaly detection. Cluster Computing, 22(1), 949-961. https://doi.org/10.1007/s10586-017-1117-8
[13] LeCun, Y., Bengio, Y., & Hinton, G. (2015). Deep learning. Nature, 521(7553), 436-444. https://doi.org/10.1038/nature14539
[14] Liu, F. T., Ting, K. M., & Zhou, Z. H. (2012). Isolation-based anomaly detection. ACM Transactions on Knowledge Discovery from Data, 6(1), 1-39. https://doi.org/10.1145/2133360.2133363
[15] Nguyen, T. A., & Reddi, V. J. (2020). Deep distributed k-means for security anomaly detection. IEEE Transactions on Knowledge and Data Engineering, 33(11), 3241-3256. https://doi.org/10.1109/TKDE.2020.3003557
[16] Phua, C., Lee, V., Smith, K., & Gayler, R. (2010). A comprehensive survey of data mining-based fraud detection research. arXiv preprint arXiv:1009.6119.
[17] Raza, S. (2017). Machine learning for network security. In V. E. Balas, N. Dey, A. E. Hassanien, & V. Snasel (Eds.), Machine Learning Paradigms: Theory and Application (pp. 297-325). Springer.
[18] Salo, F., Nassif, A. B., & Essex, A. (2019). Anomaly detection with unlabeled data: A survey. ACM Computing Surveys, 52(6), 1-36. https://doi.org/10.1145/3368601
[19] Sommer, R., & Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. 2010 IEEE Symposium on Security and Privacy, 305-316. https://doi.org/10.1109/SP.2010.25
[20] Zhang, J., & Zulkernine, M. (2006). Anomaly based network intrusion detection with unsupervised outlier detection. 2006 IEEE International Conference on Communications, 5, 2388-2393. https://doi.org/10.1109/ICC.2006.255044
[21] Srivastav, P. Nguyen, M. McConnell, K. A. Loparo and S. Mandal, "A Highly Digital Multiantenna Ground-Penetrating Radar (GPR) System," in IEEE Transactions on Instrumentation and Measurement, vol. 69, no. 10, pp. 7422-7436, Oct. 2020, doi: 10.1109/TIM.2020.2984415.
[22] Kanungo, Satyanarayan. "Hybrid Cloud Integration: Best Practices and Use Cases." International Journal on Recent and Innovation Trends in Computing and Communication (IJRITCC), vol. 9, no. 5, May 2021, pp. 62-70. Available at: http://www.ijritcc.org.
[23] Kanungo, Satyanarayan. "Decoding AI: Transparent Models for Understandable Decision-Making." Tuijin Jishu/Journal of Propulsion Technology 41, no. 4 (2020): 54-61.
[24] Kanungo, Satyanarayan, and Pradeep Kumar. "Machine Learning Fraud Detection System in the Financial Section." Webology, vol. 16, no. 2, 2019, p. 490-497. Available at: http://www.webology.org
[25] Kaur, Jagbir. "Big Data Visualization Techniques for Decision Support Systems." Vol. 42 No. 4 (2021) Articles.
[26] Kaur, Jagbir, Ashok Choppadandi, Pradeep Kumar Chenchala, Varun Nakra, and Pandi Kirupa Gopalakrishna Pandian. "AI Applications in Smart Cities: Experiences from Deploying ML Algorithms for Urban Planning and Resource Optimization." Tuijin Jishu/Journal of Propulsion Technology 40, no. 4 (2019): 50-56.
[27] Kaur, Jagbir, Ashok Choppadandi, Pradeep Kumar Chenchala, Varun Nakra, and Pandi Kirupa Gopalakrishna Pandian. "AI-Enabled Chatbots for Customer Service: Case Studies on Improving User Interaction and Satisfaction." International Journal of Transcontinental Discoveries (IJTD) 6, no. 1 (January-December 2019): 43-48. Available online at: https://internationaljournals.org/index.php/ijtd.
[28] Choppadandi, Ashok, Jagbir Kaur, Pradeep Kumar Chenchala, Varun Nakra, and Pandi Kirupa Kumari Gopalakrishna Pandian. "Automating ERP Applications for Taxation Compliance using Machine Learning at SAP Labs." International Journal of Computer Science and Mobile Computing 9, no. 12 (December 2020): 103-112. Available online at www.ijcsmc.com.
[29] Chenchala, Pradeep Kumar, Ashok Choppadandi, Jagbir Kaur, Varun Nakra, and Pandi Kirupa Gopalakrishna Pandian. "Predictive Maintenance and Resource Optimization in Inventory Identification Tool Using ML." International Journal of Open Publication and Exploration (IJOPE) 8, no. 2 (July-December 2020). Available online at: https://ijope.com.
[30] Mohammad, Naseemuddin. "Data Integrity and Cost Optimization in Cloud Migration." International Journal of Information Technology & Management Information System (IJITMIS) 12, no. 1 (2021): 44-56. IAEME Publication.
[31] Mohammad, Naseemuddin. "Enhancing Security and Privacy in Multi-Cloud Environments: A Comprehensive Study on Encryption Techniques and Access Control Mechanisms." International Journal of Computer Engineering and Technology (IJCET) 12, no. 2 (2021): 51-63. IAEME Publication.
[32] Karuturi, S. R. V., Satish, Naseemuddin Mohammad. "Big Data Security and Data Encryption in Cloud Computing." International Journal of Engineering Trends and Applications (IJETA) 7, no. 4 (2020): 35-40. Eighth Sense Research Group.

Keywords:

Anomaly Detection, Cybersecurity, Machine Learning, Supervised Learning, Unsupervised Learning, Ensemble Methods, Cyber Threats, Network Traffic Analysis, NSL-KDD, UNSW-NB15.