I want a Research Proposal and Poster presentation on a question in Data analytics

Predicting Cyber Threats Using Data Mining and

Machine Learning Techniques

Bhargava Teja Nuvvula Master’s in data Analytics

Dublin Business School (DBS) [email protected]

ABSTRACT

In recent days, the number of attacks and the attempts to breach cybersecurity is getting to increase throughout the world. These kind attacks have become one of the major problems to the companies as it might impact their business and even loss the customers if the security breaking is attempt focusing customer data. To anticipate the situation when someone tries to break the cybersecurity, we going to take the advantage of data mining and machine learning techniques for preparing a model that can perform the prediction in advance whether the incoming request is a legitimate one or it is to break the cybersecurity unit.

KEYWORDS

Cybersecurity, data mining, machine learning. Prediction

prevent attacks.

INTRODUCTION

The research topic 'Predicting Cyber Threats using data mining

and machine learning techniques' is chosen to apply machine

learning and data mining techniques for cybersecurity

applications. The tremendous growth in the field of

information technology and the usage of the internet

communication system has shown a wide range of growth and

people are motivated to use the IT environment. These changes

have major advantages and benefits, on the other hand, the

security breach with hacking techniques has become a major

threat to the IT environment. In the IT world, the graphical

distance is really minimized by establishing effective

communication and transfer the data in an easy way.

In the earlier days, the operating system was included with the

new features by adding firewalls to ensure the safety of the data

the system deals with. The firewalls in the system are to ensure

the inside and outside flow of information but it is very limited

to handle within the scope of the system. The firewalls could

not able to ensure safety when the data are transferred across

the network. As a next level, the detection system is used to

perform the analysis on the network paths when the data are

transferred to keep an eye on possible security threats that

tries to break the cybersecurity.

As a solution, we going to perform the text analysis on the

dataset which has the security breach incidents happened in

the past by the spyware and malware programs and apply the

data mining techniques. The data mining techniques will be

applied to the dataset that will understand the pattern and the

dependent variables that will enable the system to predict an

attack on the applications breaking the cybersecurity. For this

research, we going to perform the analysis on the dataset that

has been gathered from the small and medium scale companies.

The dataset has textual data that describes the incidents of

breaking the security and the actions that were taken in order

to fix the issue.

OBJECTIVE

The main objective is to develop a solution that can perform the

prediction on the Cybersecurity attacks on the IT environment

so that we can take the required actions to safeguard the

system even before the attack. This study mainly focused on

ensuring internet security by diagnosing network activity. We

will be incorporating the data mining and machine learning

techniques to prepare a solution that can analyze the network

logs, security issue description, and the solution that was

applied to fix the issue.

RESEARCH QUESTION:

The below research questions help us to understand on why we

need to prepare a solution that can predict the Cyber Threats

on the real-time.

1. What would be the effective method to handle the attacks on

the application by breaking the cybersecurity?

2. How we can anticipate the event of attacks on the security with

the help of analyzing the past incidents?

3. How the machine learning and data mining techniques can be

used to solve the real-time problems by analyzing the existing

data in the field of cybersecurity?

DATASET: The dataset was prepared by collecting the incident details

from small and medium enterprises in South Korea and the

classifier model will be trained with this dataset so that the

model can perform the prediction on the cybersecurity

incidents. The dataset was collected from 5 different

companies and preprocessed to prepare a proper input dataset.

LITERATURE REVIEW:

In the paper (The survey of data mining applications and

feature scope.,2012), it helps us to understand the importance

of the data mining technologies. Large organizations have

generated a large volume of data. The available data need to be

analyzed to take strategic decisions that will help the business

to run in a successful manner. The data mining techniques need

to apply to the huge dataset available by identifying the hidden

patterns. The data mining process can be applied to datatypes

like audio/video, text format, etc. The classification of the data

mining systems will be varied with respect to the data types

that we going to mine.

In the paper (Text clustering for digital forensics analysis.,

2009), The text mining technique was used to prepare a

clustering based on the forensics details available from the past

cases. The developed model helps to identify the similarity or

any clue that will help to proceed with the investigation. The

available digital pieces of evidence are used as an input to the

data mining process. The textual data extraction needs to be

done on the files, emails, or any other forensic reports and the

extracted need to undergo the data mining process to extract

the significant information.

In the paper (Naive Bayesian networks in intrusion detection

systems., 2004), An intrusion system is developed to avoid the

risks in terms of security on the network environment. The

human labeling will be a tedious process to audit the network

instances, so they have applied naive Bayes which is a data

mining technique that is used to perform the anomaly detection

on the network. Here, they have defined the hypothesis for the

classes and calculate the probability of the value to be true for

the defined hypothesis. From this paper, we can able to

visualize how the data mining techniques can be applied to

detect the intrusions on the network.

From the literature review papers, we could able to understand

that we did not have any specific technique that needs to be

applied to perform intrusion detection. The possible

algorithms would be decision tree, artificial neural networks,

or even clustering techniques. On top of that, we have

understood the importance of the chosen topic and need of

developing a machine learning solution for the same.

METHODOLOGY:

We have different methodologies that can be followed on the

machine learning model development. CRISP-DM, SEMMA and

KRR are some of the methodologies which was originally

designed for data mining process, but later we adopt the same

process for application development as well. For our thesis, we

going to adopt KDD which is otherwise known as Knowledge

Discovery in Databases. The process must follow the below

stages:

Selection

Preprocessing

Transformation

Data Mining

Interpretation/Evaluation

Figure 1: KDD process

Selection: In the selection phase, we create or choose a target

data set or focusing on selecting the subset of the larger dataset

by choosing the required variables that will be processed in

further exploration.

Pre-processing: In the pre-processing phase, we perform

different cleaning operations on the collected or chosen dataset

by involving a manual process or with some programming

techniques like Python. At the end of this process, we will be

obtaining consistent data that can be processed.

Transformation: In the data transformation phase, we apply

different transformation techniques on the dataset that will

convert the data into the appropriate format required by the

machine learning model. We apply techniques like dimension

reduction in this phase of the process.

Data Mining: In this phase, we apply the appropriate

techniques on the data to identify the patterns that are hidden

in the data and before we step into the identification phase, we

have to be clear on the data mining goal. In our case, the

primary aim is to perform the prediction on the cybersecurity

attacks. To be more specific, we will be applying different

classification algorithms to see the best fit for our dataset.

Pattern Evaluation: In the pattern evaluation phase, we

extract the knowledge from the available measures in the

dataset and perform the summarization on the same to make

the pattern understandable by the user. Also required

visualization will be done to better explain the observations.

Knowledge representation: In the knowledge representation

phase, we make use of different tools available to represent the

results of the data mining process. This includes generating the

reports, generating the tables, and resulting in the classification

rules.

Evaluation: At last we perform the evaluation on the

identifying patterns bypassing the input data to the model. The

classification will be done on the available dataset and

classified into training data and test data. The test data will be

passed to the model at this phase. The performance and

accuracy of the model will be evaluated to check whether it

meets the threshold value.

It is very important to understand that Knowledge Discovery in

Databases (KDD) methodology is an iterative process that can

be applied when we enhance the model in the subsequent

phases and refining the data mining process by applying

different techniques. The enhancement can be made to process

on different aspects from what we have processed already or

even it be just applying different techniques on the existing

solution.

Revisiting the data selection phase, we need to identify the

relevant data or factors that need to be analyzed in order to

make an effective decision. The data selection can be done

using the techniques/algorithms available in machine learning.

The data selection can be done using a neural network,

clustering, regression, decision tree, naive Bayes for

classification, etc. With respect to the problem statement,

available dataset, and objective, the appropriate data selection

technique needs to be applied to the data collection.

Our solution is not limited to have only the data mining process,

it includes the machine learning algorithms that will be applied

along with the data mining process to perform the prediction

of the cybersecurity attacks. So, the methodology must be

slightly modified to accommodate the additional development

steps that we are incorporating which were not addressed in

the process explained above. The data mining phase is the one

that will have additional implementation effort for developing

the machine learning model using the classification techniques.

MODEL EVALUATION:

The classification model will be evaluated using the different

evaluation metrics that help us to understand how far the

model will be capable enough to perform the prediction on the

cybersecurity attacks. Some of the metrics evaluated are the

accuracy of the model, plotting a confusion matrix, calculating

the precision score, and calculating the recall score value.

FUTURE WORK:

The proposed research work is limited to perform the

prediction on the security threads on the network transfer by

training the model only with the incident details of the security

breaking issue in the part. As future work, the machine learning

model will be upgraded to work with the mobile data transfer

for identifying the malicious attacks.

CONCLUSION:

The Intrusion Detection model that we develop to predict the

Cyber Threats using data mining and machine learning

techniques will help to avoid the misuse of internet domain for

transferring the data or making any request through the

internet. The intelligent system that we going to build can be

used in day to day life by the cybersecurity team to avoid the

manual interpretation of the requests received over online.

REFERENCE:

1. N. Padhy, P. Mishra, and R. Panigrahi, “The survey of data

mining applications and feature scope, ” International

Journal of Computer Science, Engineering and Information

Technology, vol. 2, no. 3, pp. 43–58, 2012.

2. Decherchi, S., Tacconi, S., Redi, J., Leoncini, A., Sangiacomo,

F., and Zunino, R. (2009). Text clustering for digital

forensics analysis. In Herrero, A., Gastaldo, P., Zunino, R.,

and Corchado, E., editors, Computational Intelligence in

Security for Information Systems, pages 29–36, Berlin,

Heidelberg. Springer Berlin Heidelberg.

3. B. Ahmad, W. Jian, B. Hassan, and S. Rehmatullah, “Hybrid

intrusion detection method to increase anomaly detection

by using data mining techniques,” International Journal

of Database Theory and Application, vol. 9, no. 12, pp. 231–

240, 2016.

4. N. B. Amor, S. Benferhat, and Z. Elouedi, “Naive Bayesian

networks in intrusion detection systems,” in Proceedings

of the ACM Symposium on Applied Computing, pp. 420–

424, Nicosia, Cyprus, March 2004.