Machine Learning Applied to Cyberattack Prediction

Abstract

This article summarizes the development of machine learning models to classify network traffic by extracting features from network packets. These models are helpful in intrusion detection and prevention systems (IDPS), which can improve the identification of malicious packets and reduce false positives. Including these models in IDPS systems makes them more efficient and robust. The article summarizes the laboratory work developed in the master's dissertation in data science at Universidade Lusófona of Lísbon. In this work, you can find a summary of the extraction phases at the data source, transformations, preprocessing, feature selection, and selection of the model trained and tested with the data set under analysis.

During the laboratory, 11 models were trained and tested. Still, for this article, we present more information about the models that had the best results: Random Forest, XGBoost, and Decision Tree. Three scenarios were created for the same dataset, which allowed us to study the behavior of the models under different scenarios. The first scenario refers to a binary classification problem, with two classes, that is, class 0 representing Normal Traffic and class 1 representing Attack Attempt. The second scenario refers to simple multiclass classification (different attack types), and the third and last scenario refers to balanced multiclass classification with the smote algorithm.

Ultimately, we propose reflecting on each scenario developed, highlighting two fundamental points. The first is the importance of a precise definition of the problem, which directly influences the transformations applied to the data and the selection of relevant attributes. The second point refers to the fact that achieving high accuracy rates in training and testing the model is not enough — it is crucial to consider the risk of data leakage. Variables that compromise the model's integrity, making its application in real production environments unfeasible, must be carefully identified and excluded.