Файл: Doi 10. 15514ispras201931(5)15.docx

---

сделатьобзорактуальныхтехнологийвкибербезопасностиикибератаках,использующихмашинноеобучение,ипредставитьмодельатаки наосновемашинногообучения.Ключевыеслова:кибератака;кибербезопасность;глубокоеобучение;машинноеобучение;кибератакасмашиннымобучениемДля цитирования: Авдошин С.М., Лазаренко А.В., Чичилева Н.И., Наумов П.А., Ключарев П.Г.Примерыиспользованиямашинногообучениявкибербезопасности.ТрудыИСПРАН,том31,вып.5,2019г.,стр.191-202(наанглийскомязыке).DOI:10.15514/ISPRAS-2019-31(5)-15

1.   1   2   3   4   5   6   7

---

Introduction

Cybersecurity is gaining more and more attention each Cybersecurity is gaining more and moreattention each year. The number of cyberattacks has significantly increased since 2009 due tothe digitalization of everything in the modern world. According to the Gartner Hype Cycle [1],machine learning (ML) is of great interest in the world of technology. ML is concerned withintelligentbehaviourinasystem,includingperception,reasoning,learning,communicationandacting in a complex environment [2]. Such widespread interest in ML is due to two criticalfactors:First, it canautomate processes that previously required humanparticipation,forexample,controlofroboticmechanismsinproduction(i.e.MLassumeshumanresponsibilities).Second, it can quickly process and analyze huge amounts of information and calculate optionsusing many variables. In these areas, ML provides qualitatively better results compared tohumans.ML has much to offer cybersecurity. Current implementations are widely used in IDS systems,sandbox systems and many different areas of cybersecurity – from threat intelligence datacollection to advanced automated digital forensics. In fact, 71% of US businesses plan to useML intheircybersecurity tools in2019 [3] as overone-third (36%) [3] of organizationsexperienceddamagingcyberattacksin2018.Themajority(83%)[3]confidesthatcybercriminals use ML to attack organizations. The problem of ML use in cybersecurity isdifficult to solve because the advances in the field offer so many opportunities that it is hard tofind good and beneficial use cases for implementation and decision making. Moreover, it isdifficult to determine how secure a security system is, which is used in production, and how toprotect the organization from cyberattacks conducted through ML. The main goal of the currentworkexploreMLusageincybersecurityandresearchusecasesrelatedtotheadversary’suse ofMLincyberattacks.

2. Basic definitions

ML is the process by which machines learn from given data, building the logic and predictingoutput for a given input [4]. ML has three sub-categories: supervised learning, unsupervisedlearning and reinforcement learning [5]. Supervised learning uses a dataset labelled with thecorrectanswersforstudy.Suchlabelsidentifythecharacteristicsofeachdataset.Oncethemodelis trained, it can start predicting or deciding on new data that is given to it. In unsupervisedlearning, there is no need for such a marked set of data. Once the model is given the dataset, itautomatically finds patterns and relationships by creating clusters in it. However, such type oflearningcannotpredictanything.Whennewdataisadded,themodelassignsthemtoone

---

oftheexistingclustersorcreatesanewone.Reinforcementlearningistheabilityofasystemtointeractwith the environment and identify the best outcome. The system is either rewarded or penalizedwith a point for a correct or a wrong answer, and based on positive reward points gained, themodeltrainsitself.Similarly,oncetrained,itprepares topredictnewdatapresentedtoit.Deep learning (DL) is a class of ML algorithms [6] that uses multiple layers to progressivelyextract higher-level features from the raw input. The main differences between ML and DL areas follows: ML algorithms almost always require structured data, whereas DL networks rely onlayersoftheArtificialNeuralNetworks(ANNs).Often inML,humanintervention isnecessary
to produce further outputs with more sets of data, while in DL, this is not necessary. One of thecentralconceptsinDLisANNs.TheANNisamodelthatisbuiltontheprincipleoforganizationand the functioning of the human brain (i.e. networks of nerve cells in a living organism). Inother words, a neural network algorithm tries to create a function to map one’s input to one’sdesired output. Neural networks (NNs) are typically organized in layers (fig. 1). Layers consistofanumberofinterconnected'nodes'thatcontainan'activationfunction'.Patternsarepresentedto the network via the 'input layer', which communicates to one or more 'hidden layers' wheretheactualprocessingisdoneviaasystemofweighted'connections'.Thehiddenlayersthenlinktoan'outputlayer'wheretheansweristheoutput.Fig. 1.Neuralnetworks
For example, in image processing, lower layers may identify edges, while higher layers mayidentifyconceptsrelevant toahuman,suchasdigits,lettersorfaces. IfNNshavemorethantwohiddenlayers, they are called deep neural networks (DNNs) [7].DNN is used forimagerecognition,speechrecognition and otherapplications. Moreover,technologieshavebeencreatedtogeneratenewphotographsthat

---

look at least superficially authentic to human observers through many realistic characteristics. For example, there is a known attempt to synthesize photographs of cats that has misled an expert to think they are real ones [8]. This is an example of the technology called generative adversarial network (GAN), an ML algorithm of unsupervised learning built on a combination of two NNs: one network G (generator) generates new examples and one network D (discriminator) tries to classify examples as either real or fake (generated) [9].

Fig.2.CRISP-DMprocessofdatamining

One of the processes that is inextricably linked with ML and DL is data mining. Using data mining in large datasets can identify new patterns by utilizing statistics and database systems methods [10]. The Cross-Industry Standard Process for Data Mining (CRISP-DM) describes the cross-industry process for data mining [11]. CRISP-DM breaks the process into six main phases: business understanding, data understanding, data preparation, modelling, evaluation and deployment (fig. 2). The first two phases are connected to each other. Their main aim is to determine the goals of the project, set the task for ML and collect data. These aims can be adjusted based on the data. The next phase refers to the process of working with data: cleaning the data, combining the data, if necessary, and formatting the data.

In the modelling phase, various modelling techniques are applied to the data. Models are built, and their parameters are adjusted to optimal values. Because of special data requirements in different models, we can return to the Data Preparation phase. In the evaluation phase, the model has already been built, and quantitative assessments of its quality have been obtained. Before implementing this model, we need to make sure that we have achieved all business goals. Depending on the requirements, the deployment phase may be simple (e.g. preparation of the final report) or complex (e.g. automation of the data analysis process to solve business problems).

3. 1   2   3   4   5   6   7

---