國立虎尾科技大學 |

Resilient Machine Learning Methods for Cyber-Attack Detection.

紀錄類型:	書目-語言資料,手稿 : Monograph/item
正題名/作者:	Resilient Machine Learning Methods for Cyber-Attack Detection./
作者:	Ongun, Talha.
面頁冊數:	1 online resource (175 pages)
附註:	Source: Dissertations Abstracts International, Volume: 84-10, Section: B.
Contained By:	Dissertations Abstracts International84-10B.
標題:	Computer science. -
電子資源:	click for full text (PQDT)
ISBN:	9798379412777

Resilient Machine Learning Methods for Cyber-Attack Detection.
Ongun, Talha.

Resilient Machine Learning Methods for Cyber-Attack Detection. - 1 online resource (175 pages)

Source: Dissertations Abstracts International, Volume: 84-10, Section: B.

Thesis (Ph.D.)--Northeastern University, 2023.

Includes bibliographical references

The cyber threat landscape has evolved tremendously in recent years, with new threat variants emerging daily, and large-scale coordinated campaigns becoming more prevalent with hundreds of thousands of victim machines compromised globally. Enterprises have also been targeted by advanced adversaries who leverage creative ways to infiltrate their systems and move laterally to gain access to critical infrastructure. It is challenging to detect these attacks in their early stages, as adversaries utilize common services, use novel techniques, and can blend in with benign behavior to evade existing detection mechanisms.In this dissertation, I present novel machine learning-based threat detection solutions and investigate the strength and feasibility of these techniques in different cybersecurity domains for both host-level and network-level monitoring systems. First, we study detection methods for Living-Off-The-Land activities commonly utilized by advanced malware, which hide the malicious activity behind a benign program by using tools that are already available in target systems. We develop a new command line representation method, and propose an active-learning-based approach that utilizes the limited labeled instances to build accurate classifiers to detect this behavior. Second, we study self-propagating malware (SPM) and propose unsupervised methods to detect the behavior using network logs to protect organizations against novel SPM campaigns. We propose an ensemble of anomaly detection models, and demonstrate the resilience of our method to detect evasive malware variants. Finally, we study automated collaborative learning techniques for HTTP-based malware detection using federated learning methods. This approach enables organizations to utilize attacks encountered and labeled in different networks to build better classifiers. We propose distributed embedding models for URL representation, and integrate an active learning module during collaborative training to detect new attack variants. We evaluate each of the proposed detection methods using datasets from real-world systems and demonstrate that the methods can help protect organizations against these emerging attack vectors.

Electronic reproduction.
Ann Arbor, Mich. :
ProQuest,
2024

Mode of access: World Wide Web

ISBN: 9798379412777Subjects--Topical Terms:

573171
Computer science.
Subjects--Index Terms:

CybersecurityIndex Terms--Genre/Form:

554714
Electronic books.

Resilient Machine Learning Methods for Cyber-Attack Detection.
LDR:03556ntm a2200385K 4500 001 1141080
005 20231130111607.5
006 m o d
007 cr mn ---uuuuu
008 250605s2023 xx obm 000 0 eng d
020 $a 9798379412777
035 $a (MiAaPQ)AAI30418436
035 $a AAI30418436
040 $a MiAaPQ $b eng $c MiAaPQ $d NTU
100 1 $a Ongun, Talha. $3 1464677
245 1 0 $a Resilient Machine Learning Methods for Cyber-Attack Detection.
264 0 $c 2023
300 $a 1 online resource (175 pages)
336 $a text $b txt $2 rdacontent
337 $a computer $b c $2 rdamedia
338 $a online resource $b cr $2 rdacarrier
500 $a Source: Dissertations Abstracts International, Volume: 84-10, Section: B.
500 $a Advisor: Oprea, Alina.
502 $a Thesis (Ph.D.)--Northeastern University, 2023.
504 $a Includes bibliographical references
520 $a The cyber threat landscape has evolved tremendously in recent years, with new threat variants emerging daily, and large-scale coordinated campaigns becoming more prevalent with hundreds of thousands of victim machines compromised globally. Enterprises have also been targeted by advanced adversaries who leverage creative ways to infiltrate their systems and move laterally to gain access to critical infrastructure. It is challenging to detect these attacks in their early stages, as adversaries utilize common services, use novel techniques, and can blend in with benign behavior to evade existing detection mechanisms.In this dissertation, I present novel machine learning-based threat detection solutions and investigate the strength and feasibility of these techniques in different cybersecurity domains for both host-level and network-level monitoring systems. First, we study detection methods for Living-Off-The-Land activities commonly utilized by advanced malware, which hide the malicious activity behind a benign program by using tools that are already available in target systems. We develop a new command line representation method, and propose an active-learning-based approach that utilizes the limited labeled instances to build accurate classifiers to detect this behavior. Second, we study self-propagating malware (SPM) and propose unsupervised methods to detect the behavior using network logs to protect organizations against novel SPM campaigns. We propose an ensemble of anomaly detection models, and demonstrate the resilience of our method to detect evasive malware variants. Finally, we study automated collaborative learning techniques for HTTP-based malware detection using federated learning methods. This approach enables organizations to utilize attacks encountered and labeled in different networks to build better classifiers. We propose distributed embedding models for URL representation, and integrate an active learning module during collaborative training to detect new attack variants. We evaluate each of the proposed detection methods using datasets from real-world systems and demonstrate that the methods can help protect organizations against these emerging attack vectors.
533 $a Electronic reproduction. $b Ann Arbor, Mich. : $c ProQuest, $d 2024
538 $a Mode of access: World Wide Web
650 4 $a Computer science. $3 573171
653 $a Cybersecurity
653 $a Machine learning
653 $a Malware detection
653 $a Cyber-attack detection
653 $a Cyber threat
655 7 $a Electronic books. $2 local $3 554714
690 $a 0984
690 $a 0800
710 2 $a ProQuest Information and Learning Co. $3 1178819
710 2 $a Northeastern University. $b Computer Science. $3 1464678
773 0 $t Dissertations Abstracts International $g 84-10B.
856 4 0 $u http://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=30418436 $z click for full text (PQDT)