Section: Malware Analysis

View Sample PDF

Author(s): Thomas Alan Woolman (On Target Technologies, Inc., USA)and Philip Lunsford (East Carolina University, USA)
Copyright: 2023
Pages: 18
Source title: Encyclopedia of Data Science and Machine Learning
Source Author(s)/Editor(s): John Wang (Montclair State University, USA)
DOI: 10.4018/978-1-7998-9220-5.ch139

Keywords: Data Analysis and Statistics / Engineering Science Reference / Knowledge Management and Library Science / Machine Learning

Purchase

View Section: Malware Analysis on the publisher's website for pricing and purchasing information.

Abstract

This article explores the application of anomaly detection models from network flow data using multi-layer perceptron autoencoding neural networks, for the purpose of self-supervised detection of novel network intrusion events and malware classes over unrestrained internet connections. The authors utilized network flows rather than more detailed (and larger) packet capture logs in order to create a more cost-effective and potentially faster anomaly detection tool that could more easily scale enterprise class network traffic analysis. Unsupervised/self-supervised deep learning anomaly detection was used against this less-granular dataset to maximize the likelihood of detecting novel network activities within the less-detailed dataset without relying on pre-defined rules and training data. The authors conclude with a test of statistical significance against known threat classes (unknown to the anomaly detection model) that the proposed methodology results were statistically significant for detecting threat classes in unrestrained internet networks using network flow data.

The IRMA Community

Research IRM

Section: Malware Analysis

Purchase

Abstract

Related Content

IRMA Sponsors