Binary Classification of Network-Generated Flow Data Using a Machine Learning Algorithm

2. Related Works

There is a lot of research on the classification of cyberattacks and the evaluation of machine learning algorithms on different datasets, but in this related works section we will mainly focus on works that center around the CICIDS 2017 and similar datasets.

Yavangolu and Aydos (2017) present a comprehensive review of Cyber Security datasets for machine learning algorithms. Yusof et al. (2017) compares their proposed feature selection technique with traditional techniques. Using a combination of two feature selection techniques: Consistency-based Subset Evaluation and DDoS characteristic-based features, they were able to identify and select the most significant features for the NSL-KDD 2009 dataset. Almseidin et al. (2017) performed several experiments to evaluate the efficiency and the performance of several machine learning algorithms on the KDD dataset. They found that there is no single machine learning algorithm that can handle all attack types effectively. Shafiq et al. (2016) discuss network traffic classification techniques. They capture real time internet data using a network traffic capture tool. This tool is used to extract features from the capture traffic and then four machine learning classifiers Support Vector Machine, C4.5 decision tree, Naive Bayes and Bayes Net classifiers are applied. They found that the C4.5 classifiers gave the best accuracy results as compared to other classifiers. Zhou et al. (2019)’s work realizes the importance of data pre-processing in Cyber Security data and proposes a new methodology to compare the benefits of Correlation Based Feature Selection (CFS) and the Bat Algorithm with an ensemble based on C4.5, Random Forest (RF), and Forest by Penalizing Attributes (Forest PA). Zhou et al. (2019)’s analysis also included the CICIDS 2017 dataset.