The Effectiveness of Deploying Machine Learning Techniques in Information Security to Detect Nine Attacks: UNSW-NB15 Dataset as a Case Study

Over the past few decades, the global number of internet users has seen a significant expansion [1]. This considerable growth, driven by technological advancements and worldwide digitalization, has brought numerous benefits to the international community. Such benefits include enhanced data sharing, network efficiency, productivity, customer experience, agility, data transparency, and decision-making effectiveness [2]. Moreover, digital transformation has facilitated business automation and network integration, offering critical solutions for both businesses and research [3].

The internet, technology, and digitalization collectively have streamlined the time, effort, and cost associated with data transfer and information exchange across distant locations [4]. They have also improved data and resource management, enabling daily information and statistics to be archived in network databases readily accessible to employees and managers [5]. Moreover, these platforms support the transfer and storage of sensitive information related to customers or citizens, underscoring the necessity for robust security measures to ensure data privacy [5, 6].

Internet, database, and network security have been extensively studied by scholars, yet offering efficient solutions for improved information security remains a challenge. Despite the immense benefits of digitalization, the internet, and technology, their expansion has brought about an increase in network threats and cyber-attacks [7]. The evolving nature of internet attacks and viruses necessitates the use of intelligent network-detection approaches for effective prediction and high-accuracy detection of such threats [8].

In response, researchers and computer engineers have employed machine learning (ML) algorithms and novel techniques to detect network viruses and bolster internet and online database security. ML, as a practical internet security technique, can predict powerful network attacks that are difficult to detect using conventional antivirus programs. Instead of dealing with only raw malware, ML antivirus approaches involve training a model to enhance its effectiveness and ability to predict new viruses. By exploring the key characteristics and common features of cyber threats and network viruses, ML approaches can train virus detection models to improve their performance in predicting new viruses and cyber-attacks.

This study aims to explore and assess the significant role of ML in shielding internet networks and databases from rapidly evolving cyber threats. The paper is structured as follows: Section 2 covers the key features and crucial contributions of ML in defending internet networks and databases from cyberattacks, with a focus on identifying intelligent algorithms and innovative techniques that leverage ML principles. Section 3 outlines the primary approach and methodology employed in this research. Section 4 presents the major study findings related to numerical analysis, with validation conducted using Python software to underscore the contribution of ML models and intelligent ML algorithms. This section also discusses the research outputs in relation to findings by other researchers. Lastly, Section 5 summarises the study's critical findings and outlines recommendations and proposals for future work.

The proposed methodology described in this section was employed in this study to recognize distinct types of assaults in the UNSW-NB15 cybersecurity dataset, as depicted in Figure 1. The proposed methodology is demonstrated in the ensuing sections.

3.1 Dataset description

We used in our experiment a well-known dataset that has many cybersecurity attacks: the UNSW-NB15 dataset. Table 1 shows the name of each dataset, the number of Instances, the number of features, and what are the cybersecurity attacks.

The IXIA traffic generator uses three servers to generate this dataset: two servers for normal attacks and one server for malicious attacks. This dataset contains 45 features and 257,673 instances divided into 93,000 regular attacks and 164,673 malicious attacks [16]. The vicious attacks included nine attacks: Analysis, Reconnaissance, DoS, Exploits, Fuzzers, Generic, Normal, Worms, Backdoor, and Shellcode. The features of this dataset are shown in Table 2.

1.png

Figure 1. Diagram of the proposed methodology

Table 1. Information on cybersecurity datasets

Table 2. UNSW-NB15 features

Table 3. Attack classes in UNSW-NB15 dataset

Furthermore, the classes and significant categories of cyber threats associated with those data, with their frequency and number of iterations, can be described in Table 3.

It is concluded from the data illustrated in Table 3 that the most frequent number of cyber threats associated with the UNSW-NB15 dataset is the Normal attack, corresponding to 93,000 cyber threats. In addition, the numeric data represented in Table 3 can be expressed as a graphical architecture via Figure 2.

2.png

Figure 2. UNSW-NB15 frequency attacks

It can be inferred from the data represented in Figure 2 that the Generic, Exploits, Fuzzers, Probing, and DoS Cyber Attacks come after the Normal attack in terms of frequency, contributing to iterations of 58,871, 44,525, 24,246, 23,389, and 16,353 attacks, respectively. At the same time, Worms and Shellcode have the least frequency of cyber threats, with a number of 174 and 1,511, respectively.

3.2 Dataset preparation

We use a well-known encoding approach to turn each dataset’s non-numerical features into numerical features to apply various machine-learning algorithms to them [17]. This method is known as the “Label Encoder,” and it turns non-numerical data into machine-readable forms by replacing each value with a unique number starting at 0 [17]. In the dataset, named UNSW-NB15, the proto, service, and state are categorical features. Therefore, we must convert it to numerical features. After that, the dataset was split into two datasets: a training dataset to build the models and a testing dataset to assess the performance of these models. The size of each dataset is as follows: 0.10 of the whole datasets is for testing and the remainder is a training dataset.

3.3 Main ML algorithms

To detect the aforementioned cybersecurity assaults in each dataset, the dataset is created and then fitted to seven machine learning algorithms. With a test size of 0.1, we used a hold-out approach to split the dataset into training and testing datasets. As a result, testing datasets account for 0.1 of all datasets, whereas training datasets make for 0.9 of them. The performance of the machine learning models created using the training dataset is assessed using the testing dataset.

3.3.1 Random Forest algorithm (RF)

A vast number of Decision Trees are trained in the ensemble supervised learning technique known as random forests, which is used for regression and classification applications. The class that most trees select is the predicted outcome in categorization problems. For regression tasks, the mean or average forecast of each tree is returned [18]. Decision Trees have the propensity to overfit their training set, which can be prevented using random-choice forests. To categorize any cybersecurity dataset, which includes a variety of assaults, the Random Forest classifier is used [19, 20]. Because the label in our experiment is discrete, we employed a Random Forest with a categorization type. Sqrt is the maximum number of features, none is the maximum depth, and 42 is the unexpected state. These are the RF settings that were used.

3.3.2 Decision Tree algorithm (DT)

A supervised machine learning system called a Decision Tree makes decisions based on rules, much like people do [21]. Data mining, statistics, and machine learning all use Decision Tree learning, also known as induction of Decision Trees, as a predictive modeling technique [22]. It moves from making observations about a sample (represented by the branches) to concluding the sample’s target value (represented by the attack-type leaves on a Decision Tree) [23]. Classification trees are tree models with a discrete target variable; in these tree structures, the leaves correspond to the many sorts of assaults, while the branches correspond to the characteristics of the dataset that help predict the class labels [24, 25]. Decision Trees with a continuous objective variable (usually real numbers) are known as regression trees [25]. Due to their clarity and simplicity, Decision Trees are one of the well-known machine learning algorithms. Because the label in our experiment is discrete, we utilized the Decision Tree with classification type. The DT settings we used were criterion=gini and random state=42.

3.3.3 Multilayer Perceptron algorithm (MLP)

A fully linked feedforward artificial neural network called a Multilayer Perceptron (MLP) is one type (ANN). The term “MLP” can apply to any feedforward ANN or networks made up of many layers of perceptrons, depending on the context (with threshold activation). The basic neural networks are multilayer perceptrons, especially those with a single hidden layer [26]. The minimum number of node levels for an MLP is an input layer, a hidden layer, and an output layer. Each node is a neuron with a nonlinear activation function, except the input nodes [26, 27]. MLP employs backpropagation as a supervised learning technique during training. MLP differs from a linear perceptron in that it uses nonlinear activation and has a large number of layers. It can distinguish between data that cannot be separated linearly [28]. Since the label in our experiment is discrete, we utilized the MLP with classification type, activation=relu, and random state=42.

3.3.4 eXtreme Gradient Boosting algorithm (XGBoost)

XGBoost, or extreme Gradient Boosting, is a technique for classification and regression issues. It has undergone careful parallelization and optimization for the gradient-boosting approach [29]. The training time is significantly decreased by parallelizing the entire boosting procedure. We train hundreds of models on various subsets of the training dataset instead of creating the best model that can be built using the data, and then we vote on the model that performs the best [29]. (As in traditional approaches). XGBoost frequently performs better than conventional Gradient Boosting methods [30]. You have access to a ton of inner parameters in the Python code that you may change for increased precision and accuracy [31].

This algorithm’s primary function is to transform Decision Trees, which are weak learners, into strong learners, which results in the strong learner producing the final prediction label (average of each prediction by week classifier). Numerous key characteristics of the XGBoost have been optimized [29-31]. 1) Parallelization: The model is built to operate concurrently across several CPU cores. 2) Regularization: To avoid overfitting, XGBoost provides a range of regularization penalties. Regularizations with penalties result in effective training, which permits the model to generalize effectively. Non-linearity: XGBoost can identify nonlinear data patterns and learn from them. 4) Cross-validation is available and has already been incorporated. 5) Scalability: XGBoost can run distributed, allowing you to manage massive volumes of data with the aid of distributed servers and clusters like Hadoop and Spark. Numerous programming languages are supported, including Julia, Python, C++, and Java. We utilized this technique with a classification type and the XGBoost settings of col sample by level=1, learning rate=0.1, gamma=0, n estimators=100, and random state=42 because the label in our experiment is discrete.

3.3.5 AdaBoost algorithm

A particular kind of statistical classification meta-algorithm is called AdaBoost or Adaptive Boosting. Combining it with a variety of different learning tactics can boost performance. The final output of the boosted classifier is merged with the output of additional learning algorithms, or “weak learners” [32]. In circumstances where prior classifiers misclassified them, AdaBoost adapts to the weak learners by modifying them as they come in. It might, in some cases, be less prone to the overfitting problem than other learning techniques. As long as a learner’s performance is marginally better than random guessing, even if they perform poorly individually, the final model will still condense to a potent learner [33]. AdaBoost has been shown to be effective in combining weak base learners (like decision stumps) with strong base learners (like deep Decision Trees), producing a model that is more accurate [34].

Before a learning algorithm works at its peak on a dataset, it must be configured with a number of different parameters, and most of them are more appropriate for certain issue kinds than others. The best out-of-the-box classifier is usually referred to as AdaBoost, which uses Decision Trees as weak learners [32-34]. The Decision Tree learning process employs information obtained from each stage of the AdaBoost approach to determine the relative “hardness” of each training sample. As a result, later trees focus on data that are harder to categorize [34]. Because the label in our experiment is discrete, we utilized AdaBoost with classification type, and the GB parameters we used are as follows: n estimators are 50, the learning rate is 1, the random state is 42, and the algorithm is SAMME.R.

3.3.6 Gradient Boosting algorithm (GB)

A technique of machine learning called Gradient Boosting has applications in regression and classification, among other things. It provides a prediction model in the form of several models of Decision Tree-based weak predictions [35]. A method called Gradient Boosting turns several weak learners (Decision Trees) into one powerful learner. Individual Decision Trees are poor learners in this situation [36]. Each tree in succession is connected to the one before it and works to fix the flaw of the one before it. Boosting algorithms are frequently time-consuming to train yet very accurate because of this sequential link. Slower learning models do better in statistical learning [35, 36]. Each new student in the group of weak learners fits into the residuals of the stage preceding them as the model gets better. The final model combines the findings from each phase to produce a potent learner. Utilizing a loss function, residuals are found. For instance, mean square error (MSE) and logarithmic loss (log loss) can be utilized in classification and regression, respectively. It’s crucial to understand that the model remains unchanged when a new tree is added. The additional Decision Tree matches the current model’s residuals [35-37]. Due to the discrete nature of the label in our experiment, we employed the GB with categorization type. We applied the following GB parameters: n estimators=100, learning rate=0.1, friedman mse criterion, subsample=1.0, and random state=42.

3.3.7 Voting algorithm

Voting classifiers are ensemble machine learning models that, after learning from a range of different models, predict an output (class) based on the output’s best likelihood of being the target class [38]. The output class with the highest votes will be revealed by adding the outputs of each classifier that was input into the voting classifier [39]. As opposed to creating separate, specialized models and evaluating their performance, we suggest creating a single model that trains on many models and predicts output according to the overall number of votes for each output class. Two voting processes are supported by Voting Classifier [40, 41]. 1) Hard voting: Each classifier is most likely to correctly forecast the projected output class that receives the most votes or the class that each classifier is most likely to correctly predict. 2) Soft voting: The forecast is made using an average of the likelihoods assigned to each output class and the class itself. Because the label for our experiment is discrete, we employed the voting with classification method. There were the following voting choices: The voting process uses hard voting, and the estimators are DT, RF, and XGB.

3.4 Simulation setting

This research depended on numerical calculations and simulation processes by virtue of the Python software package. In this software, a numeric code was developed and created to conduct a comparative analysis for the seven algorithms, which are:

A- Decision Tree (DT);

B- Random Forest (RF);

C- Gradient Boosting (GB);

D- XGBoost (XGB);

E- Multilayer Perceptron (MLP), and;

F- Voting.

The simulation process was accomplished via the numerical Python code to generate some statistical findings and vital outcomes associated with the seven algorithms addressed in this work.

3.5 Parameter adjustment

Based on the seven algorithms chosen in this article, this study relied on some parameters and critical variables that could help assess and examine those seven algorithms in terms of their performance and reliability. Therefore, some evaluation metrics and assessment measures were adopted. Those evaluation techniques include the following concepts:

a- Accuracy;

b- Precision;

c- Recall;

d- F1-Score.