Search

Ideally, in a real cyberattack, the early detection of probable hacker intent can lead to improved mitigation or prevention of exploitation. With the knowledge of basic principles of communication protocols, the reconnaissance/scanning phase intentions of a hacker can be inferred by detecting specific patterns of behavior associated with hacker tools and commands. Analyzing the reconnaissance behavior of the TCP Syn Scan between Nmap and the host, we built machine learning models incorporating the use of a filtering method we developed for labeling a dataset for detection of this behavior. We conclude that feature selection and detailed targeted labeling, based on behavior patterns, yield a high accuracy and F1 Score using Random Forest and Logistics Regression classifiers.

Effective data reduction must retain the greatest possible amount of informative content of the data under examination. Feature selection is the default for dimensionality reduction, as the relevant features of a dataset are usually retained through this method. In this study, we used unsupervised learning to discover the top-k discriminative features present in the large multivariate IoT dataset used. We used the statistics of principal component analysis to filter the relevant features based on the ranks of the features along the principal directions while also considering the coefficients of the components. The selected number of principal components was used to decide the number of features to be selected in the SVD process. A number of experiments were conducted using different benchmark datasets, and the effectiveness of the proposed method was evaluated based on the reconstruction error. The potency of the results was verified by subjecting the algorithm to a large IoT dataset, and we compared the performance based on accuracy and reconstruction error to the results of the benchmark datasets. The performance evaluation showed consistency with the results obtained with the benchmark datasets, which were of high accuracy and low reconstruction error.