Scholarlink

<p>Cybersecurity has become an important task to safeguard digital assets. Timely detection of cybersecurity threats and effective response are key tasks to deal with ever-complicating cyberattacks. Cyberattacks, particularly insider threats, have become a big threat to networks. Insider threat detection faces additional challenges, such as a lack of insider threat data to analyze properly. In addition, the inability of traditional approaches to distinguish between insider attacks and legitimate activity increases the likelihood that sensitive data and information can be misused by malicious insiders. To mitigate insider threats, this study utilizes multi-class machine learning models, including support vector machines (SVM), random forest (RF), K nearest neighbor (KNN), deep neural network (DNN), and Naive Bayes (NB) to detect user-centered insider threats at various granularity levels. The CERT r5.2 dataset was used in this study to create a user context model for training the models in various experiments. To establish which models are optimal for detecting each insider threat at various granularity levels, the results of several models are compared based on various criteria. Most machine learning models provided satisfactory results, except for NB and KNN, which are primarily affected by unbalanced data. Thereby, oversampling techniques were utilized to optimize the results. The proposed approach produced good results for KNN, RF, DNN, and SVM models with an accuracy of 99.9%, 95.5%, 94%, and 90.5%, respectively.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Machine Learning-Based Network Monitoring for Cybersecurity Threat Detection

  • 期刊论文

  • 发表日期：

    2025年11月14日

查看全文
  • Ala’ Abdulmajid Eshmawi,
  • Amal Al-Nowami,
  • Manar Mirza,
  • Nada Abu-Raya,
  • Rawa Al-Thabit,
  • Stavros Shiaeles,
  • Jin-Ghoo Choi,
  • Imran Ashraf

摘要

Cybersecurity has become an important task to safeguard digital assets. Timely detection of cybersecurity threats and effective response are key tasks to deal with ever-complicating cyberattacks. Cyberattacks, particularly insider threats, have become a big threat to networks. Insider threat detection faces additional challenges, such as a lack of insider threat data to analyze properly. In addition, the inability of traditional approaches to distinguish between insider attacks and legitimate activity increases the likelihood that sensitive data and information can be misused by malicious insiders. To mitigate insider threats, this study utilizes multi-class machine learning models, including support vector machines (SVM), random forest (RF), K nearest neighbor (KNN), deep neural network (DNN), and Naive Bayes (NB) to detect user-centered insider threats at various granularity levels. The CERT r5.2 dataset was used in this study to create a user context model for training the models in various experiments. To establish which models are optimal for detecting each insider threat at various granularity levels, the results of several models are compared based on various criteria. Most machine learning models provided satisfactory results, except for NB and KNN, which are primarily affected by unbalanced data. Thereby, oversampling techniques were utilized to optimize the results. The proposed approach produced good results for KNN, RF, DNN, and SVM models with an accuracy of 99.9%, 95.5%, 94%, and 90.5%, respectively.