A Comparative Study of Cyber Attack Detection &amp; Prediction Using Machine Learning Algorithms

doi:10.21203/rs.3.rs-3238552/v1

Download PDF

Research Article

A Comparative Study of Cyber Attack Detection & Prediction Using Machine Learning Algorithms

https://doi.org/10.21203/rs.3.rs-3238552/v1

This work is licensed under a CC BY 4.0 License

Version 1

posted

You are reading this latest preprint version

Nowadays, Internet utilization is expanding rapidly. This is primarily attributable to the recent tendency of cheaper electronic devices and data packages. In reality, the Internet is a vital part of people's daily lives in the modern world. Due to the high usage, our confidential information may be accidentally leaked elsewhere on the internet. Cyber security is a broad area of study that addresses the fundamentals of data misuse and internet security threats. Cyber security is crucial in every industry to protect corporate data and to comprehend assault vectors. Protecting information from Cyber-attacks has become more challenging. In this paper we present a proposed system that analyses the dataset and identifies whether given data is normal or anomalous we use machine learning algorithms to analyze datasets in the proposed system. After analyzing the dataset, attempt to identify and predict a cyber-attack. For classification, detection, and prediction of cyber-attacks, algorithms such as K Nearest Neighbour (KNN), Logistic Regression (LR), Decision Tree (DT), Gaussian Naive Bayes (GNB), Support Vector Machine (SVM), Gradient Boosting Classifier (GB) and Random Forest (RF) are used. Here we are using a dataset containing a wide variety of simulated intrusions into a military network environment that was made available. This paper compares machine learning algorithms based on parameters such as Precision, Recall, F1 Score, Accuracy, and Cross-Validation of the system and suggests which algorithm provides accurate results. Publicly available datasets (Network intrusion dataset) were analyzed in this study. These data can be found here: https://www.kaggle.com/datasets/sampadab17/network-intrusion-detection

Cyber Attack

Denial of Service Attack (DoS)

Decision Tree

Logistic Regression

Machine learning

Random Forest

The desire and necessity to keep information, data, and devices safe drives the relevance of cyber security. People currently store massive amounts of data on computers, servers, and other linked devices. Much of this is sensitive information, such as Personally Identifiable Information (PII) or financial data. Then there's the issue of intellectual property (IP).If a cybercriminal has access to this information, they may wreak havoc. They can trade critical information, exploit passwords to steal money, or even modify data to benefit themselves. Organizations must have security solutions in place to ensure compliance.

There are several conventional systems for providing security to data like Intrusion Detection System(IDS), antivirus, firewall. Conventional methods give higher false positive and false negative results. The main limitation of using an IDS is its inability to respond or stop attacks upon detection. Using an antivirus program means tons of resources from the memory and therefore the disk drive is getting used. As a result, it can drastically slow down the overall speed of the system. Moreover, they’re capable of identifying only certain sorts of threats. So as for acquiring a complete level of protection. Firewalls can protect systems from the basic types of Trojans, but they are not capable of protecting systems from other types of malware, and possibly this malware can enter the system in the form of trusted data. To handle this type of problem, anti-malware software needs to be installed along with malware. Existing cyber security frameworks not able to perform threat prediction of unknown pattern and detection.

In this paper, we present the problem statement which is to analyze the dataset to detect and predict whether it is normal or anomaly class data. Our paper aims to detect anomaly class data using several machine learning algorithms. A dataset contains two types of data: normal and anomaly. On a given dataset, we present an analysis of various machine learning algorithms. In addition, we conducted a comparative analysis of the output of each algorithm to determine whether our prediction was true or not. Every algorithm is executed in two ways with the feature selection step and without the feature selection step. Comparative studies also reveal how each algorithm performs with and without feature selection.

The aim of this paper is to classify the instances as secured or insecure communication based on the attributes in the given dataset. In particular, a record is designated as either anomaly or normal class depending on the features of the military dataset. The specific objectives of the paper are as follows.

To test if the feature selection always has an impact on the prediction.
To justify the efficacy of the groups of algorithms in classifying the anomaly.
To determine robustness of the algorithms and select the best algorithm.

Comparative studies also reveal how each algorithm performs with and without feature selection. We assessed the algorithms for Accuracy, Precision, Recall, F1 Score, and Cross-Validation score.

Publicly available datasets (Network intrusion dataset) were analyzed in this study. These data can be found here: https://www.kaggle.com/datasets/sampadab17/network-intrusion-detection

Key contributions are as follows.

1. In this study, experiments are performed with Logistic Regression (LR), Gaussian Naive Bayes (GNB),

Support Vector Machine (SVM),Decision Tree (DT),Extra Tree Classifier(ETC),Voting Classifier(VC),Random Forest (RF),K Nearest Neighbour (KNN),Bagging Classifier(BC), Gradient Boosting Classifier (GB) ,Adaboost Classifier (AC)and Xgboost Classifier(XB) algorithms are used for classification and detection of cyber-attacks.

2. Comparative analysis of the output of every algorithm

The rest of the paper is structured as follows. The literature review is covered in Section II. In Section III, the proposed system approach is covered. In section IV, experimental research is covered. The conclusion of this research study and future work are both found in Section V.

In the modern world, digitization and the internet have altered human lifestyles by expanding social and commercial connections. On the other hand, cybercriminals are using this platform to their benefit and abusing systems to steal private data. Cyber security professionals in the IT industry can mitigate this danger of exploitation. A model was put up by S. Sandosh et al. [13] to address the issues of high accuracy with little complexity and speed. For the objective of splitting the data, modified k-means clustering was used. The traffic flow is then categorized as either a known attack or an unknown attack using the KNN classification technique. Updating and upgrading the security of every internet-connected device is required to prevent data from cyber threats.

An efficient semi-supervised method to reduce false positive rates and boost detection rates was described by Raniyah Wazirali [14]. Data's dimensionality is decreased via Principal Component Analysis (PCA). Utilizing the k-nearest neighbor's hyper parameter adjustment and five-fold cross-validation, the fresh data is categorized.

The ability to detect cyber anomalies, attacks, and invasions has been extensively researched in the area of cyber security. In the cyber enterprise, both the anomaly-based intrusion detection system (AIDS) and the signature-driven intrusion detection system (SIDS) are well-known for identifying and preventing cyber-attacks [10]. SIDS are built on known attack signatures[14].I. H. Sarker [8], uses a decision tree classification strategy with feature selection and is effective in terms of prediction accuracy as well as decreasing the feature dimensions. The main objectives for developing this Digital Assault Location Model system [11], according to the authors, are: Build a computerized discovery system using a database scan to work with multi-layered information, rope to reduce dimensionality, and select the appropriate organizational characteristics for grouping various types of assault. Develop a framework that uses AI calculations to detect hidden hazards.

Pre-processing is completed to remove missing values, anomalies, and so on, and the significant highlights are discovered from the pre-handled data by using the correct component determination formula[5]. The outfit method is used for the arrangement because it produces extremely confident choices and works on overall precision by cooperating. In practice, cyber security issues may entail a large number of security features, and the effectiveness of a learning-based security model may differ depending on the significance of the associated security features and data characteristics. Various types of machine learning techniques and their applicability in the area of cyber security, have been discussed in Sarker et al. [8], however, a detailed analysis is needed to decide on the area.

Mona Alduailijet al. [3] describes a cloud computing mechanism for detecting DDoS attacks. The primary purpose of this article is to reduce misclassification mistakes in DDoS detection. The suggested study employs two feature selection techniques, namely the Mutual Information (MI) and Random Forest Feature Importance (RFFI) methods, to identify the most relevant features. Random Forest (RF), Gradient Boosting (GB), Weighted Voting Ensemble (WVE), K Nearest Neighbour (KNN), and Logistic Regression are applied to selected variables. (LR). The experimental results show that the accuracy of RF, GB, WVE, and KNN with 19 characteristics is 0.99. The current systems have some shortcomings. The majority of studies have worked to increase accuracy and decrease false positive rates. However, some systems still have problems with overfitting, time complexity, and increased prediction inaccuracy.

The followings are some gaps that need to be taken care of,

1. Identification of hidden/new patterns of attack in datasets

Example-Ransomware is one of the most serious internet security issues that we face in the digital world.

2. Higher rate of False Positive (FP) and False Negative (FN). It will directly affect the accuracy of the model.

3. To predict the type of attack potentially to happen in future

In this section, we addressed several authors' research findings on machine learning-based cyber-attack detection models. The research shortcomings were also discussed.

A thorough explanation of the system methodology is provided in this section. The Proposed Model is illustrated in Fig. 1. Based on the dataset and machine learning methods, we created a framework/model for cyber-attack classification and prediction in this study. The dataset contains binary classification data i.e. it has only two classes normal & anomaly. The following are the major steps in this framework.

1. To select which dataset will be used.

2. Data preprocessing methods to deal with irrelevant data from the dataset and data encoding.

3. Feature Extraction to pick up the best attributes from a dataset to construct a model with better detection accuracy and speed.

4. The data is split into a train and test set for the model. In this step, we will construct and train our proposed model.

5. We train the model using machine learning algorithms such as LR,GNB,SVM,DT,ETC, VC,RF,KNN,BC,GB,AC,XB.

6. A test data set is applied to the trained model, and the model's performance is evaluated using the parameters precision, recall, F1 Score, Cross-validation score (CV), accuracy, training score, and testing score.

In this study, we used two approaches for executing the code one includes a feature selection step and the other does not (without feature selection). For training the model, we used the machine learning algorithms K Nearest Neighbour (KNN), Logistic Regression (LR), Decision Tree (DT), Gaussian Naive Bayes (GNB), Support Vector Machine (SVM), Gradient Boosting Classifier (GB) and Random Forest (RF)

3.1 Data Set

Data is taken from Kaggle for experimentation [32]. It is an open-source repository. A dataset containing a broad range of simulated intrusions into a military network environment was made available for audit. Each connection is assigned one of two labels: normal or anomaly class. An average connection log is 100 bytes long. The data set contains a total of 42 columns and total records of 47,735.

3.2 Data Preprocessing

In this raw data is prepared and makes it suitable for applying to ML algorithms. In this step, we are checking whether the dataset contains some missing values, null values, and redundant values. So the processing is done to remove these from data sets.

3.3 Feature Extraction

Feature Extraction extracts the finest attributes from a dataset to build a model with improved detection accuracy and speed. The dataset includes 42 columns in total, with 10 features chosen from among them. These features are then used for training purposes. The recursive Feature Elimination model [3] is used for feature elimination. In comparison to other feature selection techniques, the accuracy of random forest feature importance is great. The aim of recursive feature elimination (RFE) is to select features by examining smaller and smaller sets of features recursively. First, the estimator is trained on the initial collection of features

The least significant features are then cleaned from the current set of features. This method is continued on the pruned set recursively until the desired number of features to select is reached.

Data Splitting:- In this scenario, the data set with the characteristics chosen is divided using the train-test split technique. The classification system employs 30% of testing data and 70% of training data to identify assaults. Machine learning algorithms are then fed the training and assessment data sets.

3.4 Machine Learning Algorithms

In this model, we are applying machine learning algorithms K Nearest Neighbour (KNN), Logistic Regression (LR), Decision Tree (DT), Gaussian Naive Bayes (GNB), Support Vector Machine (SVM), Gradient Boosting Classifier (GB) and Random Forest (RF)

1. Logistic Regression (LR):- It is a machine learning technique that can be used for classification problems. It forecasts a categorical dependent variable's output. The outcome of a categorical dependent variable is predicted using logistic regression. As a result, the conclusion must be distinct or categorical. Logistic regression works well on the binary class label [3].

2. Gaussian Naive Baye (GNB):- Gaussian Naive Bayes (GNB) is a classification technique used in Machine Learning (ML) based on the probabilistic approach and Gaussian distribution. Gaussian Naive Bayes assumes that each parameter (also called features or predictors) has an independent capacity of predicting the output variable. The combination of the prediction for all parameters is the final prediction that returns a probability of the dependent variable to be classified in each group. The final classification is assigned to the group with the higher probability [31].

3. Support Vector Machine (SVM):- It categorizes data pieces that are not otherwise linearly separable by mapping data to a high-dimensional feature space. A separator is discovered between the groups, and the data are processed so that the separator may be shown as a hyperplane [8].

4. Decision Tree (DT):-The Decision Tree algorithm examines attributes on internal nodes, and the results are expressed by branches, with leaf nodes containing class labels. The goal is to create a model that uses simple decision rules built from data attributes to forecast the value of a target variable [30].

5. Extra Tree Classifier (ETC):- The extra trees algorithm, creates many decision trees, but the sampling for each tree is random, without replacement. This creates a dataset for each tree with unique samples. A specific number of features, from the total set of features, are also selected randomly for each tree. The most important and unique characteristic of extra trees is the random selection of a splitting value for a feature. Instead of calculating a locally optimal value using Gini or entropy to split the data, the algorithm randomly selects a split value. This makes the trees diversified and uncorrelated.

6. Voting Classifier (VC): - It simply aggregates the findings of each classifier passed into Voting Classifier and predicts the output class based on the highest majority of voting. The idea is instead of creating separate dedicated models and finding the accuracy for each them, we create a single model which trains by these models and predicts output based on their combined majority of voting for each output class [33].

7. Random Forest (RF):- It is a Meta estimator that employs averaging to improve predicted accuracy and control over-fitting by training many decision tree classifiers on distinct sub-samples of the dataset [30]

8. K Nearest Neighbour (KNN):- The K-NN algorithm maintains all available data and classifies new data points based on similarity. KNN is a classification approach that classifies test data observations, based on how close they are to the nearest class neighbor. KNN is used as a semi-supervised learning approach. It is based on a nonparametric approach to classify samples. The distance between separate points on the input vector is determined, and the unlabeled point is, then, allocated to the neighboring class K. K is the main parameter in the KNN classification [3].

9. Bagging classifier (BC)-: is an ensemble meta-estimator that fits base classifiers each on random subsets of the original dataset and then aggregate their individual predictions (either by voting or by averaging) to form a final prediction.

10. Gradient Boosting (GB):- It enables us to obtain a predictive model as an ensemble of weak prediction models, such as decision trees. The resulting approach is known as a gradient-boosted tree when a decision tree operates as a weak learner. It enables us to blend predictions from different learner models to create a final predictive model with the correct prediction [3].

11. Adaboost Classifier (AC):- It falls under ensemble boosting techniques, it combines multiple models to produce more accurate results and this is done in two phase’s i.e multiple weak learners are allowed to learn on training data and Combining these models to generate a meta-model, this meta-model aims to resolve the errors as performed by the individual weak learners [33].

12. Xgboost (XB):- is an optimized distributed gradient boosting library designed for efficient and scalable training of machine learning models. It is an ensemble learning method that combines the predictions of multiple weak models to produce a stronger prediction. Its ability to handle large datasets and its ability to achieve state-of-the-art performance in many machine learning tasks such as classification and regression [33].

3.5 Trained Model: - In this step, a test data set is applied to the trained model, and the model's performance is evaluated using the parameters precision, recall, F1 Score, Cross Validation (CV) Score, Accuracy, Training Score, and Testing Score.

3.6 ANOVA Test: - is used to compare the means of different groups using various estimate methodologies. ANOVA is an abbreviation for the analysis of variance. The ANOVA analysis is a statistical relevance tool designed to evaluate whether or not the null hypothesis can be rejected while testing hypotheses. It is used to determine whether or not the means of three or more groups are equal. Whenever there are more than two or more independent groups, the ANOVA test is used [33].

3.7 Paired t-Test: - It helps the data analytics to compare two means that are taken from the same data set to determine if the difference is zero. In the statistical procedure of Paired t-test also known as dependent sample t-test every data set say individual, unit or object is measured twice consequential providing the pairs of observation for paired t-Test[33].

3.8 Friedman test: - It is a non-parametric test alternative to the one way ANOVA with repeated measures. It tries to determine if subjects changed significantly across occasions/conditions. It is used to test for differences between groups when the dependent variable is ordinal [33].

3.9 Wilcoxon signed-rank test:- It is also known as Wilcoxon matched pair test is a non-parametric hypothesis test that compares the median of two paired groups and tells if they are identically distributed or not[33].

In this section, we have discussed the proposed system. This proposed system works with binary class data and different machine learning algorithms are applied to it. For Performance evaluation Precision, Recall, F1 Score, and CV Score these parameters are considered. In the Result analysis we will check the performance of the mentioned algorithm and which algorithm gives higher accuracy.

During the experimentation, we took the system outcome in two forms: one with a feature selection step and one without. Precision, Recall, F1 Score, Cross Validation, Train Score, and Test Score are the outcomes. The experiment was done using a Laptop where the operating system was Windows 10 Enterprise 64-bit, Processor was Intel(R) Core(TM) i3 CPU and Python programming language was used.

Table 1

Performance Evaluation with Feature Selection
Algorithm	Precision	Recall	F1 Score	Accuracy
LR	92.351	92.432	92.389	92.312
GNB	91.762	89.231	89.176	89.19
SVM	97.543	97.327	97.160	97.155
DT	99.520	99.500	99.054	99.404
ET	99.381	99.010	99.981	99.986
VC	92.043	98.061	94.119	94.112
RF	99.580	99.815	99.985	99.986
KNN	98.451	98.243	98.308	98.306
BC	99.031	99.053	99.987	99.986
GB	98.140	98.521	98.390	98.391
AB	97.054	98.021	98.912	98.915
XG	99.581	99.851	99.986	99.986

Table 1 shows the Performance Evaluation (With Feature Selection) with different machine learning algorithms. An experiment conducted with Feature selection in this for parameters Precision, Recall, and F1 Score Random Forest (RF) gives a 100% score Decision tree (DT) gives a 99% score for each parameter. Also for parameter Accuracy, Random Forest (RF) gives a 99% score and DT gives a 99% score. From the observations, we can state that RF and DT give more accurate results.

Table 2

Performance Evaluation without Feature Selection
Algorithm	Precision	Recall	F1 Score	Accuracy
LR	87.540	87.570	87.530	0.870
GNB	58.643	87.562	47.783	56.723
SVM	57.872	69.952	70.562	54.982
DT	99.340	99.351	99.302	99.370
ET	99.215	99.148	99.186	99.190
VC	89.061	97.023	93.017	93.201
RF	99.465	99.389	99.981	99.982
KNN	98.471	98.364	99.286	99.386
BC	99.641	99.582	99.981	99.986
GB	99.281	99.472	98.562	98.600
AB	98.532	99.190	99.863	99.806
XG	99.682	99.840	99.656	99.800

The Same Machine Learning Algorithms are executed without feature selection and then we check the performance of it. Table 4.2 shows the Performance Evaluation (Without Feature Selection) with different machine learning algorithms.Experiment conducted without Feature selection in this for parameters Precision, Recall, F1 Score and Accuracy Bagging Classifier (BC) and XgBoost (XB) Achieves 100% Score.

Decision Tree (DT), Extra Tree Classifier (ETC) Random Forest (RF) and Gradient Boosting (GB) achieves 99% Score for Precision and Recall parameter.

From the observations we can state that without feature selection Decision Tree (DT), Random Forest (RF), Bagging Classifier (BC), Xgboost (XB) and Gradient Boosting (GB) gives accurate results.

Figure2 shows the proposed system accuracy with & without feature selection. For Accuracy parameter Random Forest (RF), Bagging Classifier (BC), Extra Tree Classifier (ETC) and Xgboost (XB) achieves 100% score. Also Decision tree (DT) achieves 99% score.

With Feature selection Random Forest (RF) Precision value is 100%, Decision Tree (DT), Extra Tree Classifier (ETC), Bagging Classifier (BC) and Xgboost (XB) precision value is 99%.

Without Feature selection Decision Tree(DT),Extra Tree Classifier(ETC),Random Forest (RF),Bagging Classifier(BC),Gradient Boosting(GB),Adaboost Classifier(ABC)and Xgboost (XB) Precision value is 99%. K Nearest Neighbour (KNN) precision value is 0.98%.

Above mentioned Fig. 3 Shows a Comparison of Precision values with & without feature selection in each algorithm. With Feature selection Random Forest (RF) Precision value is 1, Gradient Boosting (GB) and K Nearest Neighbour (KNN) precision value is 0.98. Without Feature selection, Random Forest (RF) Precision value is 0.99, Gradient Boosting (GB) Precision value is 0.99, and K Nearest Neighbour (KNN) and Decision Tree (DT) precision value is 0.97.

Figure4 shows a Comparison of the Recall value with & without feature selection in each algorithm. With Feature selection Random Forest (RF) Recall value is 100\%. Decision Tree (DT), Extra Tree Classifier (ETC), Bagging Classifier (BC) and Xgboost (XB) Recall value is 99%.

Without Feature Decision Tree (DT), Extra Tree Classifier (ETC), Random Forest (RF), Bagging Classifier (BC), Gradient Boosting (GB), Adaboost Classifier (ABC) and Xgboost (XB) Recall value is 99%. K Nearest Neighbour (KNN) precision value is 98%.

Also, the Experiment conducted without feature selection the goal of CV is to evaluate a machine learning model's ability to predict new data. Experiment conducted with feature selection for parameter CV Score of Decision tree (DT) and Random Forest (RF) gives 99% score.

Also Experiment conducted without feature selection for parameter CV score of Decision Tree (DT) and Random Forest (RF) gives 97% score. In both the experimentation Random Forest (RF) gives highest score. So we can say that Random Forest (RF) achieves high prediction ability.

Table 3

Performance Evaluation with Feature Selection
Algorithm	Train Score	Test Score	CV Score
LR	92.877	92.312	92.849
GNB	89.48	89.191	0.892
SVM	96.931	97.155	96.756
DT	100.000	99.364	99.5
ET	99.996	99.986	99.0132
VC	94.395	94.112	94.38
RF	99.992	99.986	99.637
KNN	98.0945	98.121	96.665
BC	99.996	99.986	99.62
GB	99.448	99.391	99.296
AB	98.9004	98.915	98.758
XG	99.992	99.986	99.676

Table 3 shows the Train, Test, and CV Score with feature selection. Train Score of Decision Tress (DT) is 100%. Random Forest (RF),Extra Tree Classifier (ETC),Bagging Classifier(BC),Gradient Boosting(GB) and Xgboost (XB)algorithm has a Train, Test Score and CV Score is 99%.From Observations we can say that Random Forest (RF),Bagging Classifier(BC),Xgboost (XB) and Decision Tress (DT) algorithm achieves higher accuracy for classification and prediction of attacks.

Table 4

Train, Test, and CV Score without feature selection
Algorithm	Train Score	Test Score	CV Score
LR	92.877	92.312	92.849
GNB	89.48	89.191	0.892
SVM	96.931	97.155	96.756
DT	100.000	99.364	99.5
ET	99.996	99.986	99.0132
VC	94.395	94.112	94.38
RF	99.992	99.986	99.637
KNN	98.0945	98.121	96.665
BC	99.996	99.986	99.62
GB	99.448	99.391	99.296
AB	98.9004	98.915	98.758
XG	99.992	99.986	99.676

Table 4 shows the Train, Test, and CV Score without feature selection. Train Score of Decision Tress (DT) is 100\%.

Random Forest (RF),Extra Tree Classifier (ETC),Bagging Classifier(BC),Gradient Boosting(GB),Adaboost Classifier(AC) and Xgboost (XB)algorithm has a Train, Test Score and CV Score is 99%.From Observations we can say that Random Forest (RF) and Decision Tress (DT) algorithm achieves higher accuracy for classification and prediction of attacks.

From the Observations, we can state that Extra Tree Classifier (ETC), Random Forest (RF), Bagging Classifier (BC) and Xgboost (XB) Algorithms achieves higher accuracy in terms of classification and prediction in both models (With & without Feature selection) execution. Next, K Nearest Neighbour (KNN), Decision Tree (DT), Adaboost (AC) and Gradient Boosting (GB) Algorithms also achieve higher accuracy in terms of classification and prediction in both (With & without Feature selection) models execution.

After analyzing the performance of the system we came to know that there is a minor difference in results with feature selection and without. Results may vary depending on the dataset values.

Because of the rapid pace of technological change, securing the system is a difficult job. Nowadays Cyber-attack detection is a challenging task. We have presented the comparative machine learning approach for cyber-attack identification and prediction. For Experimental analysis, two classes (Normal & Anomaly) dataset is used. Different machine learning algorithms are used with the dataset. We have executed the proposed model in two modes i.e with feature selection and without feature selection

After analyzing the results we can say that system achieved better Accuracy, Precision, Recall, F1 Score with a Decision Tree, Random Forest and Xgboost algorithm of 99%. K Nearest Neighbour, Gradient Boosting also achieves higher accuracy 98%.

The system's application is in network security surveillance. In further research, we will work with a multiclass data set and check the system performance. Also, try to work with complex types of cyber-attacks.

Conflicts of Interest

The authors declare no conflict of interest.

Author Contribution

Main Contribution of author is to identify whether given data is normal or anomaly. Also to predict which type of cyber-attack will be happen in future .In this paper author compares different machine learning algorithms based on parameters such as Precision, Recall, F1 Score, Accuracy, and Cross-Validation of the system and suggests which algorithm provides accurate results.

Kousik Barik, Sanjay Misra, Karabi Konar, Luis Fernandez-Sanz & Murat Koyuncu," Cybersecurity Deep: Approaches, Attacks Dataset, and Comparative Study", Applied Artificial Intelligence, Published with license by Taylor & Francis Group, pp 1-25, DOI: 10.1080/08839514.2022.2055399,2022
Blessing Guembe, Ambrose Azeta, Sanjay Misra, Victor Chukwudi Osamor, Luis Fernandez-Sanz & Vera Pospelova," The Emerging Threat of Ai-driven Cyber Attacks: A Review", Applied Artificial Intelligence, Published with license by Taylor & Francis Group,1-36, DOI: 10.1080/08839514.2022.2037254,2022
Mona Alduailij, Qazi Waqas Khan, Muhammad Tahir, Muhammad Sardaraz, Mai Alduailij, and Fazila Malik," Machine-Learning-Based DDoS Attack Detection Using Mutual Information and Random Forest Feature Importance Method", Cloud Computing and Symmetry: Latest Advances and Prospects,1-15, DOI https://doi.org/10.3390/sym14061095,2022
Arpitha. B, Sharan. R, Brunda. B. M, Indrakumar. D. M, Ramesh, "Cyber Attack Detection and notifying System using ML Techniques", Indian Journal of Computer Science and Engineering (IJCSE), pp 28153-28159,2021
Fahima Hossain, Marzana Akter and Mohammed Nasir Uddin," Cyber Attack Detection Model (CADM) Based on Machine Learning Approach ",2nd International Conference on Robotics, Electrical and Signal Processing Techniques (ICREST), pp 567-572,2021
Abdulkadir Bilen and Ahmet Bedri Özer," Cyber-attack method and perpetrator prediction using machine learning algorithms", PeerJ Computer Science, pp 475-496,2021
Florian Klaus Kaiser, Tobias Budiga," Attack Forecast and Prediction ", C&ESAR'21: Computer Electronics Security Application Rendezvous, pp 77-97, 2021
Iqbal H. Sarker, CyberLearning: Effectiveness analysis of machine learning security modeling to detect cyber-anomalies and multi-attacks, Internet of Things, Volume 14,2021,100393, ISSN 2542-6605,
I. H. Sarker, Y. B. Abushark, F. Alsolami, A. I. Khan, Intrudtree: A machine learning based cyber security intrusion detection model, Symmetry 12 (5) (2020) 754.
I. H. Sarker, A. Kayes, S. Badsha, H. Alqahtani, P. Watters, A. Ng, Cybersecurity data science: an overview from a machine learning perspective, Journal of Big Data 7 (1) (2020) 1–29.
Y. N. Soe, Y. Feng, P. I. Santosa, R. Hartanto, K. Sakurai, Machine learning-based iot-botnet attack detection with sequential architecture, Sensors 20 (16) (2020) 4372.
A. Bansal and S. Kaur, "Data Dimensionality Reduction (DDR) Scheme for Intrusion Detection System Using Ensemble and Standalone Classifiers," In Proc. International Conference on Advances in Computing and Data Sciences, vol. 1045, pp. 436-451, 2019. doi 10.1007/978-981-13-9939-8 39 [Accessed 15 July 2020].
S. Sandosh, V. Govindasamy, and G. Akila, "Enhanced intrusion detection system via agent clustering and classification based on outlier detection," Peer-to-Peer Networking and Applications, vol. 13, no. 3, pp. 1038-1045, 2020. doi: 10.1007/s12083-019-00822-3 [Accessed 15 July 2020
R. Wazirali, "An Improved Intrusion Detection System Based on KNN Hyperparameter Tuning and Cross-Validation," Arabian Journal for Science and Engineering, vol. 45, no. 12, pp. 10859-10873, 2020. doi 10.1007/s13369-020-04907-7 [Accessed 19 August 2020].
Twinkle Shah, Sagar Parmar, Kishan Panchal," Cyber Crime Attack Prediction", International Research Journal of Engineering and Technology, pp 1037–1042. 2020
Kumar, "Cyber-attack prediction using machine learning algorithms", International Conference on Advances in Computing, Communication and Control (ICAC3), pp 1–5,2020
A. Ahmim, M. Ferrag, L. Maglaras, M. Derdour and H. Janicke, "A Detailed Analysis of Using Supervised Machine Learning for Intrusion Detection," Strategic Innovative Marketing and Tourism, pp. 629-639, 2020.
W. Zong, Y. Chow, and W. Susilo, "Interactive three-dimensional visualization of network intrusion detection data for machine learning," Future Generation Computer Systems, vol. 102, pp. 292-306, 2020
O. Sarumi, A. Adetunmbi, and F. Adetoye, "Discovering computer networks intrusion using data analytics and machine intelligence," Scientific African, vol. 9, p. p 1-5, 2020.
A. Nagaraja, B. Uma, and R. Gunupudi, "UTTAMA: An Intrusion Detection System Based on Feature Clustering and Feature Transformation," Foundations of Science, vol. 25, no. 4, pp. 1049-1075,2020.
A. Saleh, F. Talaat, and L. Labib, "A hybrid intrusion detection system (HIDS) based on prioritized k-nearest neighbors and optimized SVM classifiers", Artificial Intelligence Review, vol. 51, no. 3, pp. 403-443, 2020.
H. Liu and A. Gegov, "Collaborative Decision Making by Ensemble Rule-Based Classification Systems," Studies in Big Data, pp. 245-264, 2020.
P. Negandhi, Y. Trivedi and R. Mangrulkar, "Intrusion Detection System Using Random Forest on the NSL-KDD Dataset," Emerging Research in Computing, Information, Communication and Applications, pp. 519-531, 2019.
C. Gayathri Harshitha, M. Kameswara Rao, and P. Neelesh Kumar, "A Novel Mechanism for Host-Based Intrusion Detection System," In Proc. , "First International Conference on Sustainable Technologies for Computational Intelligence, pp. 527-536, 2019.
Y. Ever, B. Sekeroglu and K. Dimplier, "Classification Analysis of Intrusion Detection on NSL-KDD Using Machine Learning Algorithms," In Proc. International Conference on Mobile Web and Intelligent Information Systems, pp. 111-122, 2019.
T. Tang, D. McLernon, L. Mhamdi, S. Zaidi and M. Ghogho, "Intrusion Detection in SDN-Based Networks: Deep Recurrent Neural Network Approach," Deep Learning Applications for Cyber Security, pp. 175-195, 2019.
A. Gupta, G. Prasad and S. Nayak, "A New and Secure Intrusion Detecting System for Detection of Anomalies Within the Big Data," Studies in Big Data, pp. 177-190, 2018.
M. Ibrahim, "An empirical comparison of random forest-based and other learning-to-rank algorithms, "Pattern Analysis and Applications, vol. 23, no. 3, pp. 1133-1155, 2019.
M. G. Raman, N. Somu, S. Jagarapu, T. Manghnani, T. Selvam, K. Krithivasan, V. S. Sriram, An efficient intrusion detection technique based on support vector machine and improved binary gravitational search algorithm, Artificial Intelligence Review (2019) 1–32.
Mahmudul Hasan, Md. Milon Islam, Md Ishrak Islam Zarif, M.M.A. Hashem, "Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches", Internet of Things, Volume 7,2019,100059, ISSN 2542-6605,https://doi.org/10.1016/j.iot.2019.100059.
https://pub.towardsai.net/gaussian-naive-bayes-explained-and-hands-on-with-scikit-learn-4183b8cb0e4c
https://www.kaggle.com/datasets/sampadab17/network-intrusion-detection
https://www.geeksforgeeks.org/

No competing interests reported.

Download PDF

Version 1

posted

You are reading this latest preprint version

A Comparative Study of Cyber Attack Detection & Prediction Using Machine Learning Algorithms

Status:

Version 1

Abstract

Figures

1. Introduction

2. Literature Survey

3. Methodology

3.1 Data Set

3.2 Data Preprocessing

3.3 Feature Extraction

3.4 Machine Learning Algorithms

4. Result Analysis

5. Conclusion

Declarations

Conflicts of Interest

Author Contribution

References

Additional Declarations

Status:

Version 1