Machine Learning Techniques for Cybersecurity

Description

This book explores machine learning (ML) defenses against the many cyberattacks that make our workplaces, schools, private residences, and critical infrastructures vulnerable as a consequence of the dramatic increase in botnets, data ransom, system and network denials of service, sabotage, and data theft attacks. The use of ML techniques for security tasks has been steadily increasing in research and also in practice over the last 10 years. Covering efforts to devise more effective defenses, the book explores security solutions that leverage machine learning (ML) techniques that have recently grown in feasibility thanks to significant advances in ML combined with big data collection and analysis capabilities. Since the use of ML entails understanding which techniques can be best used for specific tasks to ensure comprehensive security, the book provides an overview of the current state of the art of ML techniques for security and a detailed taxonomy of security tasks and corresponding ML techniques that can be used for each task. It also covers challenges for the use of ML for security tasks and outlines research directions.  While many recent papers have proposed approaches for specific tasks, such as software security analysis and anomaly detection, these approaches differ in many aspects, such as with respect to the types of features in the model and the dataset used for training the models. In a way that no other available work does, this book provides readers with a comprehensive view of the complex area of ML for security, explains its challenges, and highlights areas for future research. This book is relevant to graduate students in computer science and engineering as well as information systems studies, and will also be useful to researchers and practitioners who work in the area of ML techniques for security tasks. Preface Contents Acronyms 1 Introduction 1.1 Artificial Intelligence, Machine Learning, and Deep Learning 1.2 Security Functions 1.2.1 Security Policy Learning 1.2.2 Software Security Analysis 1.2.3 Hardware Security Analysis 1.2.4 Detection 1.2.5 Attack Management 1.3 Security Life Cycle 1.4 Organization of This Monograph 2 Background on Machine Learning Techniques 2.1 Preliminary Notions 2.2 Neural Networks 2.3 Autoencoders 2.3.1 Denoising Autoencoders 2.3.2 Variational Autoencoders 2.4 Recurrent Networks and Long Short-Term Memory 2.5 Attention Mechanism 2.6 Reinforcement Learning 2.7 Transfer Learning 2.7.1 Notations and Definitions 2.7.2 Fine-Tuning 2.7.3 Domain Adaptation 2.8 Embedding Techniques 3 Security Policy Learning 3.1 Access Control Policies 3.1.1 Learning Access Control Policies 3.1.2 Policy Transfers Across Domains 3.1.3 DL Models for Access Control Decisions 3.1.4 Model-Independent Policy Mining 3.2 Network Security Policies 3.2.1 Firewall Rule Miners 3.2.2 ML-Based Firewall Systems 3.2.3 Network Security Policies for Traditional Networks 3.2.4 Network Security Policies for IoT 3.3 Privacy Policy Contradiction Identification 3.4 Adaptive Security Policy Learning Systems 3.5 Research Directions 4 Software Security Analysis 4.1 Static Analysis 4.1.1 A Survey on Machine Learning Techniques for Source Code Analysis 4.1.2 Recent Approaches 4.2 Fuzzing Techniques 4.2.1 Fuzzing Steps 4.2.2 ML-Based Fuzzing 4.3 NLP-Based Techniques for Specification Analysis 4.3.1 Finite State Machine Extraction 4.3.2 Zero-Shot Protocol Information Extraction 4.3.3 4G LTE Testcase Generation 4.3.4 Semantic Information Analysis of Developer's Guide 4.3.5 Security-Specific Change Request Detection 4.3.6 Capturing Privacy-Related Settings in Android 4.4 Supporting Techniques 4.4.1 Neural Network-Based Function and Type Identification 4.4.2 Reverse Engineering 4.5 Research Directions 5 Hardware Security Analysis 5.1 ML-Based Hardware Test Input Generation 5.2 ML-Based Detection of Hardware Trojans 5.3 Research Directions 6 Detection 6.1 Types of Malware 6.2 ML-Based Anomaly Detection 6.2.1 Networks 6.2.2 IoT Systems 6.2.3 Cyber-Physical Systems 6.2.4 Ransomware 6.3 Malware Detection and Classification 6.3.1 Portable Executable File Format 6.3.2 Analysis and Detection Techniques 6.3.3 Data Preparation and Labeling for ML-Based Malware Analysis 6.3.4 Malware Detection and Analysis: Features for Specific Platforms 6.3.5 Malware Representation 6.4 Research Directions 7 Attack Management 7.1 Attack Mitigation 7.2 Defense Enhancement 7.3 Digital Forensics 7.3.1 NLP-Based Attack Analysis 7.3.2 Transformer-Based Contextual Analysis of Security Events 7.3.3 GNN-Based Memory Forensic Analysis 7.3.4 An Explanation Method for GNNs Models 7.4 Research Directions 8 Case Studies 8.1 The Target Data Breach 8.2 The SolarWinds Attack 8.3 The WannaCry Ransomware 9 Challenges in the Use of ML for Security 9.1 Data Availability and Quality 9.2 Selection of Models, Hyperparameters, and Configurations 9.2.1 Selecting the Right Model 9.2.2 Hyperparameter and Configuration Tuning 9.3 Ethics 9.3.1 Explainability 9.3.2 Fairness 9.3.3 Robustness 9.3.4 Transparency 9.3.5 Privacy 9.4 Security of ML 9.5 Research Directions 10 Concluding Remarks Appendix: Publicly Available Datasets References