Enhancing Cybersecurity through Machine Learning-driven Anomaly Detection Systems

Abstract

Detecting anomalies inherent in a dataset is a critical task in many areas. Since anomalies can be attributed to defects in systems and examples of 0day attacks, discovering abnormal samples has become an important issue in a burgeoning number of domains. Although many ML algorithms produce satisfactory performance levels when labeling normal and abnormal samples is simple, if designing such a label is difficult, these models require numerous labeled samples to accomplish an accurate normal-abnormal characterization of the features inherent in a data collection.

In this work, cybersecurity is enhanced by automating the design of Machine Learning (ML) anomaly detection systems to protect the systems from never-before-seen (0day) attacks. There are two strategies that this project follows to accomplish this objective. Firstly, new strategies for expanding the usage of labels to provide more information for the designed anomaly detection system are developed by creating an innovative representation of the features. Secondly, Multiple Instance Learning (MIL) is extended to a more generalized setting called Transformation-based Multiple Instance Learning (TMMIL) for designing ML algorithms to perform well with more training data.

Cybersecurity deals with protecting systems connected to the web from attacks by hackers or terrorists. However, most existing cybersecurity techniques make use of signatures for detecting attacks. If a hacker crafts a new strike, after the hacker performs the strike, the trend of the strike is studied and signatures are then available to the general public so that the strike can be detected in the future.