• Level: ING3
  • Semester: Autumn
  • Duration: 15h
  • Language: French (English possible)
  • Teacher: Pierre Parrend

Summary

The growth of massive data flows within systems and networks, on one hand, and the increasing number and complexity of cyberattacks, on the other, make the automation of cybersecurity tools necessary in companies and organizations. Machine learning is a key technology for this automation: it enables the classification of traffic into known attack categories (supervised approach), and the identification of abnormal behavior (unsupervised approach).

This module enables students to deploy a structured machine learning approach applied to cybersecurity, to select algorithms suited to the analysis objectives, and to know the main use cases such as network monitoring or Security Operating Centers (SOC).

Objectives

After completing this module, students will be able to:

  • Know applications of machine learning for cybersecurity
  • Implement and evaluate learning algorithms
  • Implement data preparation and analysis tools
  • Run a data analysis pipeline for anomaly detection via machine learning on a dataset representative of a real case
  • Implement and defend against adversarial algorithms
  • Visualize adversarial attacks
  • Perform adversarial attacks
  • Perform an end-to-end forensic analysis

Lecture outline

  • Machine learning for security
    • Use cases
    • Algorithms
    • The data analysis pipeline
  • Anomaly detection
    • Novelty detection, anomaly detection
    • Detecting anomalies in 1 dimension with LSTM
    • Novelty detection algorithms: 1-Class SVM
    • Anomaly detection algorithms: Elliptic Envelope, Isolation Forest, Local Outlier Factor
    • Evaluating detection: true/false positives/negatives, precision/recall, evaluation metrics for balanced datasets (accuracy, TNR, AUROC) and imbalanced datasets (F1-score, Balanced Accuracy, MCC, AUPRC)
    • Evaluating detection: underfitting, overfitting, good fit
  • Case study
    • Methodology
    • Exploratory Data Analysis (EDA)
    • Data cleaning and visualization
    • Statistical analysis — correlation
    • Machine learning analysis — classification
  • Adversarial Machine Learning
    • Definitions
    • Exploitation examples: Tay
    • Evasion of binary classifiers
    • Poisoning of classifiers
    • Sponge poisoning
    • Learning spaces, transferability of attacks
    • Evaluation: robust accuracy, distance metrics
    • Attack types
    • Protecting against adversarial machine learning: defense classification, operational aspects

References

  • Chio, C., & Freeman, D. (2018). Machine learning and security: Protecting systems with data and algorithms. O’Reilly Media, Inc.
  • Melis, M., Demontis, A., Pintor, M., Sotgiu, A., & Biggio, B. (2019). secml: A python library for secure and explainable machine learning.
  • Caviglione, L., Wendzel, S., & Mazurczyk, W. (2017). The future of digital forensics: Challenges and the road ahead. IEEE Security & Privacy, 15(6), 12-17.
  • Parrend, P., Navarro, J., Guigou, F., Deruyver, A., & Collet, P. (2018). Foundations and applications of artificial intelligence for zero-day and multi-step attack detection. EURASIP Journal on Information Security, 2018(1), 1-21.
  • Hady, A. A., Ghubaish, A., Salman, T., Unal, D., & Jain, R. (2020). Intrusion detection system for healthcare systems using medical and network data: A comparison study. IEEE Access, 8, 106576-106584.