Handling minority class problem in threats detection based on heterogeneous ensemble learning approach.

Eke, Hope; Petrovski, Andrei; Ahriz, Hatem

Abstract

Multiclass problem, such as detecting multi-steps behaviour of Advanced Persistent Threats (APTs) have been a major global challenge, due to their capability to navigates around defenses and to evade detection for a prolonged period of time. Targeted APT attacks present an increasing concern for both cyber security and business continuity. Detecting the rare attack is a classification problem with data imbalance. This paper explores the applications of data resampling techniques, together with heterogeneous ensemble approach for dealing with data imbalance caused by unevenly distributed data elements among classes with our focus on capturing the rare attack. It has been shown that the suggested algorithms provide not only detection capability, but can also classify malicious data traffic corresponding to rare APT attacks.

Citation

EKE, H., PETROVSKI, A. and AHRIZ, H. 2020. Handling minority class problem in threats detection based on heterogeneous ensemble learning approach. International journal of systems and software security and protection [online], 13(3), pages 13-37. Available from: https://doi.org/10.4018/IJSSSP.2020070102

• Journal Article Type: Article
• Acceptance Date: Mar 6, 2020
• Online Publication Date: Jul 31, 2020
• Publication Date: Dec 31, 2020
• Deposit Date: Jun 1, 2020
• Publicly Available Date: Aug 1, 2021
• Journal: International journal of systems and software security and protection
• Print ISSN: 2640-4265
• Electronic ISSN: 2640-4273
• Publisher: IGI Global
• Peer Reviewed: Peer Reviewed
• Volume: 11
• Issue: 2
• Article Number: 2
• Pages: 13-37
• DOI: https://doi.org/10.4018/IJSSSP.2020070102
• Keywords: Imbalance data; Resampling techniques; Multi-steps; Multiclass classification; Oversampling; SMOTE; Recurrent neural network; Long short-term memory; Gated recurrent unit; Ensemble techniques
• Public URL: https://rgu-repository.worktribe.com/output/877439