Machine Learning for Cybersecurity

As cybersecurity threats keep growing exponentially in scale, frequency, and impact, legacy-based threat detection systems have proven inadequate. This has prompted the use of machine learning (hereafter, ML) to help address the problem. But as organizations increasingly use intelligent cybersecurity techniques, the overall efficacy and benefit analysis of these ML-based digital security systems remain a subject of increasing scholarly inquiry. The present study seeks to expand and add to this growing body of literature by demonstrating the applications of ML-based data analysis techniques to various problem domains in cybersecurity. To achieve this objective, a rapid evidence assessment (REA) of existing scholarly literature on the subject matter is adopted. The aim is to present a snapshot of the various ways ML is being applied to help address cybersecurity threat challenges.

Cybercrimes have become a multibillion-dollar industry in the recent years. Most cybercrimes/cyberattacks involve deploying some type of malware. Malware that viciously targets every industry, every sector, every enterprise, and even individuals has shown its capabilities to take entire business organizations offline and cause significant financial damage in billions of dollars annually. Malware authors are constantly evolving in their attack strategies and sophistication and are developing malware that is difficult to detect and can lay dormant in the background for quite some time in order to evade security controls. Given the above argument, traditional approaches to malware detection are no longer effective. As a result, deep learning models have become an emerging trend to detect and classify malware. This paper proposes a new convolutional deep learning neural network to accurately and effectively detect malware with high precision. This paper is different than most other papers in the literature in that it uses an expert data science approach by developing a convolutional neural network from scratch to establish a baseline of the performance model first, explores and implements an improvement model from the baseline model, and finally evaluates the performance of the final model. The baseline model initially achieves 98% accurate rate, but after increasing the depth of the CNN model, its accuracy reaches 99.183 which outperforms most of the CNN models in the literature. Finally, to further solidify the effectiveness of this CNN model, we use the improved model to make predictions on new malware samples within our dataset.

Malware anomaly detection is a major research area as new variants of malware continue to wreak havoc on business organizations. In this study, we propose a new technique based on the Local outlier factor algorithm to detect anomalous malware behavior. We empirically validate the performance and effectiveness of our technique on real-world datasets. This is an efficient technique for malware detection as the model trained for this purpose is based on unsupervised learning. The model trains on the anomalies, that is, the unusual behavior in a process, making it significantly effective.