The DOI matches its Crossref record; 72 of the 72 references it cites were found in a registry or an index.
The Role of Machine Learning in Cybersecurity
Open accessAbstract
Machine Learning (ML) represents a pivotal technology for current and future information systems, and many domains already leverage the capabilities of ML. However, deployment of ML in cybersecurity is still at an early stage, revealing a significant discrepancy between research and practice. Such a discrepancy has its root cause in the current state of the art, which does not allow us to identify the role of ML in cybersecurity. The full potential of ML will never be unleashed unless its pros and cons are understood by a broad audience. This article is the first attempt to provide a holistic understanding of the role of ML in the entire cybersecurity domain—to any potential reader with an interest in this topic. We highlight the advantages of ML with respect to human-driven detection methods, as well as the additional tasks that can be addressed by ML in cybersecurity. Moreover, we elucidate various intrinsic problems affecting real ML deployments in cybersecurity. Finally, we present how various stakeholders can contribute to future developments of ML in cybersecurity, which is essential for further progress in this field. Our contributions are complemented with two real case studies describing industrial applications of ML as defense against cyber-threats.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
LeCun, Y., Bengio, Y., & Hinton, G. (2015) · Nature · doi:10.1038/nature14539 · Cited by 84,126
Machine learning: Trends, perspectives, and prospects
Jordan, M. I., & Mitchell, T. M. (2015) · Science · doi:10.1126/science.aaa8415 · Cited by 9,955
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332
The EU General Data Protection Regulation (GDPR)
Voigt, P., & von dem Bussche, A. (2017) · doi:10.1007/978-3-319-57959-7 · Cited by 3,001
Zhang, L., Afanasyev, A., Burke, J., Jacobson, V., claffy, K., Crowley, P., Papadopoulos, C., Wang, L., & Zhang, B. (2014) · ACM SIGCOMM Computer Communication Review · doi:10.1145/2656877.2656887 · Cited by 2,270
Deep Learning Approach for Intelligent Intrusion Detection System
Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., & Venkatraman, S. (2019) · IEEE Access · doi:10.1109/access.2019.2895334 · Cited by 1,946
A survey of information-centric networking
Ahlgren, B., Dannewitz, C., Imbrenda, C., Kutscher, D., & Ohlman, B. (2012) · IEEE Communications Magazine · doi:10.1109/mcom.2012.6231276 · Cited by 1,630
Wild patterns: Ten years after the rise of adversarial machine learning
Biggio, B., & Roli, F. (2018) · Pattern Recognition · doi:10.1016/j.patcog.2018.07.023 · Cited by 1,409
Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI 2017)
Amendola, G., Ricca, F., & Truszczyński, M. (2017) · International Joint Conference on Artificial Intelligence · Cited by 1,179
Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
(2018) · doi:10.1145/3243734 · Cited by 1,165
Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey
Liu, H., & Lang, B. (2019) · Applied Sciences · doi:10.3390/app9204396 · Cited by 1,133
Samek, W., Wiegand, T., & Müller, K.-R. (2017) · arXiv · doi:10.48550/arxiv.1708.08296 · Cited by 1,080
A survey of network-based intrusion detection data sets
Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Hotho, A. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.005 · Cited by 947
Machine learning based phishing detection from URLs
Sahingoz, O. K., Buber, E., Demir, O., & Diri, B. (2019) · Expert Systems with Applications · doi:10.1016/j.eswa.2018.09.029 · Cited by 857
Federated learning for predicting clinical outcomes in patients with COVID-19
Dayan, I., Roth, H. R., Zhong, A., Harouni, A., Gentili, A., Abidin, A. Z., Liu, A., Costa, A. B., Wood, B. J., Tsai, C.-S., et al. (2021) · Nature Medicine · doi:10.1038/s41591-021-01506-3 · Cited by 842 · cited 2×
“Fascinating examples of practical achievements of ML are machine translation [168], travel and vacation recommendations [77], object detection and tracking [139] and even various applications in healthcare [57].”
BackgroundAndroZoo: collecting millions of Android apps for the research community
Allix, K., Bissyandé, T. F., Klein, J., & Le Traon, Y. (2016) · Proceedings of the 13th International Conference on Mining Software Repositories · doi:10.1145/2901739.2903508 · Cited by 825
Proceedings 2002 IEEE International Conference on Data Mining. ICDM 2002
(2002) · 2002 IEEE International Conference on Data Mining, 2002. Proceedings. · doi:10.1109/icdm.2002.1183878 · Cited by 727
Deep reinforcement learning for cyber security
Nguyen, T. T., & Reddi, V. J. (2023) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3121870 · Cited by 620
A Survey of Deep Learning Methods for Cyber Security
Berman, D. S., Buczak, A. L., Chavis, J. S., & Corbett, C. L. (2019) · Information · doi:10.3390/info10040122 · Cited by 569
Survey of machine learning techniques for malware analysis
Ucci, D., Aniello, L., & Baldoni, R. (2019) · Computers & Security · doi:10.1016/j.cose.2018.11.001 · Cited by 569
BAT: Deep Learning Methods on Network Intrusion Detection Using NSL-KDD Dataset
Su, T., Sun, H., Zhu, J., Wang, S., & Li, Y. (2020) · IEEE Access · doi:10.1109/access.2020.2972627 · Cited by 434
Morocho-Cayamcela, M. E., Lee, H., & Lim, W. (2019) · IEEE Access · doi:10.1109/access.2019.2942390 · Cited by 418
Proceedings 2002 IEEE Symposium on Security and Privacy
(2002) · doi:10.1109/secpri.2002 · Cited by 374
Performance Evaluation of Supervised Machine Learning Algorithms for Intrusion Detection
Belavagi, M. C., & Muniyal, B. (2016) · Procedia Computer Science · doi:10.1016/j.procs.2016.06.016 · Cited by 334
Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection
Demontis, A., Melis, M., Biggio, B., Maiorca, D., Arp, D., Rieck, K., Corona, I., Giacinto, G., & Roli, F. (2019) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2017.2700270 · Cited by 288
Intrusion detection system for automotive Controller Area Network (CAN) bus system: a review
Lokman, S.-F., Othman, A. T., & Abu-Bakar, M.-H. (2019) · EURASIP Journal on Wireless Communications and Networking · doi:10.1186/s13638-019-1484-3 · Cited by 278
A Comprehensive Survey for Intelligent Spam Email Detection
Karim, A., Azam, S., Shanmugam, B., Kannoorpatti, K., & Alazab, M. (2019) · IEEE Access · doi:10.1109/access.2019.2954791 · Cited by 246
Defensive Distillation is Not Robust to Adversarial Examples
Carlini, N., & Wagner, D. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1607.04311 · Cited by 216
Adversarial Machine Learning Applied to Intrusion and Malware Scenarios: A Systematic Review
Martins, N., Cruz, J. M., Cruz, T., & Henriques Abreu, P. (2020) · IEEE Access · doi:10.1109/access.2020.2974752 · Cited by 213
Artificial Intelligence Security: Threats and Countermeasures
Hu, Y., Kuang, W., Qin, Z., Li, K., Zhang, J., Gao, Y., Li, W., & Li, K. (2023) · ACM Computing Surveys · doi:10.1145/3487890 · Cited by 196
Proceedings of the Internet Measurement Conference
(2019) · doi:10.1145/3355369 · Cited by 190
Applying machine learning and natural language processing to detect phishing email
Alhogail, A., & Alsabih, A. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102414 · Cited by 182
Phishing Email Detection Using Improved RCNN Model With Multilevel Vectors and Attention Mechanism
Fang, Y., Zhang, C., Huang, C., Liu, L., & Yang, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2913705 · Cited by 177
A review of generative adversarial networks and its application in cybersecurity
Yinka-Banjo, C., & Ugot, O.-A. (2019) · Artificial Intelligence Review · doi:10.1007/s10462-019-09717-4 · Cited by 165
Applicability of machine learning in spam and phishing email filtering: review and approaches
Gangavarapu, T., Jaidhar, C. D., & Chanduka, B. (2020) · Artificial Intelligence Review · doi:10.1007/s10462-020-09814-9 · Cited by 163
How Machine Learning Changes the Nature of Cyberattacks on IoT Networks: A Survey
Bout, É., Loscrì, V., & Gallais, A. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3127267 · Cited by 150
SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE DetectionPreprint
Harang, R., & Rudd, E. M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.07634 · Cited by 145
Jalali, M. S., Siegel, M., & Madnick, S. (2018) · The Journal of Strategic Information Systems · doi:10.1016/j.jsis.2018.09.003 · Cited by 144
The Cross-Evaluation of Machine Learning-Based Network Intrusion Detection Systems
Apruzzese, G., Pajola, L., & Conti, M. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3157344 · Cited by 142
Self-citationApplied Machine Learning predictive analytics to SQL Injection Attack detection and prevention
Uwagbole, S. O., Buchanan, W. J., & Fan, L. (2017) · IFIP/IEEE International Symposium on Integrated Network Management (IM) · doi:10.23919/inm.2017.7987433 · Cited by 133
Heuristic nonlinear regression strategy for detecting phishing websites
Babagoli, M., Aghababa, M. P., & Solouk, V. (2018) · Soft Computing · doi:10.1007/s00500-018-3084-2 · Cited by 133
Maschmeyer, L., Deibert, R. J., & Lindsay, J. R. (2020) · Journal of Information Technology & Politics · doi:10.1080/19331681.2020.1776658 · Cited by 122
A New Method for Flow-Based Network Intrusion Detection Using the Inverse Potts Model
Pontes, C. F. T., de Souza, M. M. C., Gondim, J. J. C., Bishop, M., & Marotta, M. A. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3075503 · Cited by 122
EC2: Ensemble Clustering and Classification for Predicting Android Malware Families
Chakraborty, T., Pierazzi, F., & Subrahmanian, V. S. (2017) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2017.2739145 · Cited by 121
Deep Reinforcement Adversarial Learning Against Botnet Evasion Attacks
Apruzzese, G., Andreolini, M., Marchetti, M., Venturi, A., & Colajanni, M. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3031843 · Cited by 117
Self-citationIdentifying and Benchmarking Key Features for Cyber Intrusion Detection: An Ensemble Approach
Binbusayyis, A., & Vaiyapuri, T. (2019) · IEEE Access · doi:10.1109/access.2019.2929487 · Cited by 109
Proceedings of the 30th Annual Computer Security Applications Conference
(2014) · doi:10.1145/2664243 · Cited by 105
Yin, J., Tang, M., Cao, J., & Wang, H. (2020) · Knowledge-Based Systems · doi:10.1016/j.knosys.2020.106529 · Cited by 101
Applying Deep Learning to Airbnb Search
Haldar, M., Abdool, M., Ramanathan, P., Xu, T., Yang, S.-L., Duan, H., Zhang, Q., Barrow-Williams, N., Turnbull, B., Collins, B. M., et al. (2018) · Knowledge Discovery and Data Mining · doi:10.1145/3292500.3330658 · Cited by 100
McKinnel, D. R., Dargahi, T., Dehghantanha, A., & Choo, K. R. (2019) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2019.02.022 · Cited by 93
Tools for Automated Analysis of Cybercriminal Markets
Portnoff, R. S., Afroz, S., Durrett, G., Kummerfeld, J. K., Berg-Kirkpatrick, T., McCoy, D., Levchenko, K., & Paxson, V. (2017) · International World Wide Web Conference (WWW) · doi:10.1145/3038912.3052600 · Cited by 89
Hardening Random Forest Cyber Detectors Against Adversarial Attacks
Apruzzese, G., Andreolini, M., Colajanni, M., & Marchetti, M. (2020) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2019.2961157 · Cited by 80
Self-citationArtificial intelligence and machine learning in dynamic cyber risk analytics at the edge
Radanliev, P., Roure, D. D., Walton, R., Kleek, M. G. V., Montalvo, R. M., Maddox, L., Santos, O., Burnap, P., & Anthi, E. (2020) · SN Applied Sciences · doi:10.1007/s42452-020-03559-4 · Cited by 79
Cracking Classifiers for Evasion: A Case Study on the Google's Phishing Pages Filter
Liang, B., Su, M., You, W., Shi, W., & Yang, G. (2016) · International World Wide Web Conference (WWW) · doi:10.1145/2872427.2883060 · Cited by 64
Stakeholder perspectives and requirements on cybersecurity in Europe
Fischer‐Hübner, S., Alcaraz, C., Ferreira, A., Fernández-Gago, C., López, J., Markatos, E. P., Islami, L., & Akil, M. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.102916 · Cited by 55
Alert-driven Attack Graph Generation using S-PDFA
Nadeem, A., Verwer, S., Moskal, S., & Yang, S. J. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3117348 · Cited by 51
A novel Machine Learning-based approach for the detection of SSH botnet infection
Garre, J. T. M., Pérez, M. G., & Ruiz‐Martínez, A. (2020) · Future Generation Computer Systems · doi:10.1016/j.future.2020.09.004 · Cited by 49
Biggio, B., Corona, I., He, Z.-M., Chan, P. P. K., Giacinto, G., Yeung, D. S., & Roli, F. (2015) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-20248-8_15 · Cited by 47
A Review on Android Ransomware Detection Using Deep Learning Techniques
Alzahrani, N., & Alghazzawi, D. (2019) · International Conference on Management of Digital EcoSystems (MEDES) · doi:10.1145/3297662.3365785 · Cited by 39
Economics of Artificial Intelligence in Cybersecurity
Kshetri, N. (2021) · IT Professional · doi:10.1109/mitp.2021.3100177 · Cited by 38
Proceedings of the Australasian Computer Science Week Multiconference
(2016) · doi:10.1145/3014812 · Cited by 36
Events-Based Security Monitoring Using MMT Tool
Wehbi, B., de, E. M., & Bourdellès, M. (2012) · IEEE International Conference on Software Testing, Verification and Validation (ICST) · doi:10.1109/icst.2012.188 · Cited by 35
Detection and Threat Prioritization of Pivoting Attacks in Large Networks
Apruzzese, G., Pierazzi, F., Colajanni, M., et al. (2017) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2017.2764885 · Cited by 33
Self-citationBoenisch, F., Battis, V., Buchmann, N., & Poikela, M. E. (2021) · Mensch und Computer (MuC) · doi:10.1145/3473856.3473869 · Cited by 19
ASSERT: attack synthesis and separation with entropy redistribution towards predictive cyber defense
Okutan, A., & Yang, S. J. (2019) · Cybersecurity · doi:10.1186/s42400-019-0032-0 · Cited by 17
A methodology for conducting efficient sanitization of HTTP training datasets
Díaz-Verdejo, J. E., Estepa, A., Estepa, R., Madinabeitia, G., & Muñoz-Calle, F. J. (2020) · Future Generation Computer Systems · doi:10.1016/j.future.2020.03.033 · Cited by 16
Explanation-Guided Diagnosis of Machine Learning Evasion Attacks
Amich, A., & Eshete, B. (2021) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-90019-9_11 · Cited by 15
On the Variety and Veracity of Cyber Intrusion Alerts Synthesized by Generative Adversarial Networks
Sweet, C. R., Moskal, S., & Yang, S. J. (2020) · ACM Transactions on Management Information Systems · doi:10.1145/3394503 · Cited by 9
Bridging the gap to real-world for network intrusion detection systems with data-centric approachPreprint
Bertoli, G. D. C., Júnior, L. A. P., Verri, F. A. N., dos Santos, A. L., & Saotome, O. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.13655 · Cited by 9
Cited by
Evolving techniques in cyber threat hunting: A systematic review
Mahboubi, A., Luong, K., Aboutorab, H., Bui, H. T., Jarrad, G., Bahutair, M., Camtepe, S., Pogrebna, G., Ahmed, E., Barry, B., et al. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104004 · Cited by 94
Metadata
- Authors
- Apruzzese, G., Laskov, P., Montes de Oca, E., Mallouli, W., Brdalo Rapa, L., Grammatopoulos, A. V., & Di Franco, F.
- Venue
- Digital Threats: Research and Practice
- Published
- 2023-03-07
- Volume
- 4
- Issue
- 1
- Pages
- 1-38
- ISSN
- 2576-5337 (ISSN-L)
- 2692-1626
- OpenAlex
- W4283313119
- Cited by
- 279
- References
- 72
- FWCI
- 23.06
- Type
- journal article
- Language
- en
- Open access
- diamond
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
