Detecting Anomalies and Multi-attacks Through Cyber Learning: An Experimental Analysis

Detecting cyber-anomalies and attacks are becoming a rising concern these days in the domain of cybersecurity. The knowledge of artificial intelligence (AI), particularly the machine learning techniques, can be used to tackle these issues. However, the effectiveness of a learning-based security model may vary depending on the security features and the data characteristics. In this chapter, we present a machine learning-based cybersecurity modeling with correlated-feature selection and a comprehensive empirical analysis on the effectiveness of various machine learning-based security models. In our cyber learning modeling, we take into account a binary classification model for detecting anomalies and multi-class classification model for various types of cyberattacks. To build the security model, we first employ the popular ten machine learning classification techniques, such as naive Bayes, logistic regression, stochastic gradient descent, K-nearest neighbors, support vector machine, decision tree, random forest, adaptive boosting, extreme gradient boosting, as well as linear discriminant analysis. We then present the artificial neural network-based security model considering multiple hidden layers. The effectiveness of these learning-based security models is examined by conducting a range of experiments utilizing the two most popular security datasets, UNSW-NB15 and NSL-KDD. Overall, this chapter aims to serve as a reference point for data-driven security modeling through our experimental analysis and findings in the context of cybersecurity.