Data Mining for Malicious Code Detection and Security Applications

Data mining is the process of posing queries and extracting patterns, often previously unknown from large quantities of data using pattern matching or other reasoning techniques. Data mining has many applications in security including for national security as well as for cyber security. The threats to national security include attacking buildings, destroying critical infrastructures such as power grids and telecommunication systems. Data mining techniques are being investigated to find out who the suspicious people are and who is capable of carrying out terrorist activities. Cyber security is involved with protecting the computer and network systems against corruption due to Trojan horses, worms and viruses. Data mining is also being applied to provide solutions such as intrusion detection and auditing. The first part of the presentation will discuss my joint research with Prof. Latifur Khan and our students at the University of Texas at Dallas on data mining for cyber security applications For example; anomaly detection techniques could be used to detect unusual patterns and behaviors. Link analysis may be used to trace the viruses to the perpetrators. Classification may be used to group various cyber attacks and then use the profiles to detect an attack when it occurs. Prediction may be used to determine potential future attacks depending in a way on information learnt about terrorists through email and phone conversations. Data mining is also being applied for intrusion detection and auditing. Other applications include data mining for malicious code detection such as worm detection and managing firewall policies. This second part of the presentation will discuss the various types of threats to national security and describe data mining techniques for handling such threats. Threats include non real-time threats and real-time threats. We need to understand the types of threats and also gather good data to carry out mining and obtain useful results. The challenge is to reduce false positives and false negatives. The third part of the presentation will discuss some of the research challenges. We need some form of real-time data mining, that is, the results have to be generated in real-time, we also need to build models in real-time for realtime intrusion detection. Data mining is also being applied for credit card fraud detection and biometrics related applications. While some progress has been made on topics such as stream data mining, there is still a lot of work to be done here. Another challenge is to mine multimedia data including surveillance video. Finally, we need to maintain the privacy of individuals. Much research has been carried out on privacy preserving data mining. In summary, the presentation will provide an overview of data mining, the various types of threats and then discuss the applications of data mining for malicious code detection, cyber security and national security. Then we will discuss the consequences to privacy.

The trends of data mining on healthcare data for improving medical services have increased because of the electronic healthcare record(EHR) system, which collects a massive amount of data on a daily basis. In the current scenario, hospital maintains its EHR system and stores the detailed information of patients. Data mining for healthcare improvement requires the data from all the EHR systems located at a different location to be stored at the central data mining server. Collection of healthcare data at some untrusted central data mining server raises privacy threats. Healthcare data contains patients’ private information and sharing this information for data mining creates privacy issues. Most of the previous research either focused on k-anonymity technique which causes information loss and decreases data mining accuracy or privacy preserving data mining which is focused on only specific data mining technique. We adopt source anonymous technique as privacy preserving scheme and present a novel scheme for healthcare data collection and mining in this paper. Our scheme collects data from all EHR systems without any information loss and stores at a single central data mining server, also ensuring privacy is preserved. Central data mining server helps to analyze the collected data with different data mining techniques (Association rule mining, Classification, Clustering, etc.) without the involvement of EHR systems. Our scheme is collusion resilient against central data mining server and EHR systems. Theoretical and experimental analysis show the efficiency of our scheme in terms of computation and communication cost. The experimental results using Heart disease dataset show the advantage to EHR systems using the proposed approach in terms of disease prediction accuracy.

With the rapid development of big data and data analysis technology, a large amount of data is collected and used for data mining. However, the prediction accuracy of data mining often fails to meet the needs of third-party data users, and holders may not explicitly and openly share their data. How to share data and handle data privacy issues between entities while ensuring error-free prediction becomes a challenging problem. Therefore, privacy preserving data mining(PPDM) technology was introduced. Among them, the random perturbation method is a direct and effective method to protect data privacy by modifying some sensitive attribute values. This paper proposes a new method of data mining for privacy protection, which is based on SVM machine learning algorithm for data mining and great balances the utility and security of data. JHI and WBC data sets in machine learning database were used in the experiment, and machine learning privacy protection parameters were used for security evaluation. Experiments were conducted to compare NMF and NMFSVD algorithms, and the experiments results show that RNP privacy protection data mining method not only has less error, but also can better protect the privacy of the data set.

With a paradigm shift to untact environments, security threats on the network also have been significantly increasing all over the world. To monitor and detect intrusion attempts under enormous network traffic, Security Operation Center (SOC) essentially exploits various security devices. Above all, Network Intrusion Detection System (NIDS) has been operated in public/private sectors as a spearhead to fight against cyber threats. In particular, state-of-the-art technologies, especially ML and AI, have been being studied to achieve quick and accurate intrusion detection. Despite much effort to guarantee a secure network, however, SOCs are still struggling for overcoming various types of threats as well as attacks of similar form with benign traffic. Even though the advanced techniques may find out a complex and unknown attack, operating and managing them in real-world situations cause counterproductively more pressure to agents in the SOC. In order to solve these difficulties, this study introduces an easy-to-use framework to build intrusion detection models based on AI techniques, as well as to operate them depending on a situation using a graphical user interface. The framework supports generating various types of AI- and ML-based intrusion detection models with optimized parameters by only a few steps. Furthermore, an interactive graphical interface makes it easier to manage detection models according to different threat situations. Finally, the performance of models made by the framework is evaluated in terms of accuracy, especially under the real-world SOC environment with live network traffic.

In the era of intelligent information, the technological development of the 4th industrial revolution is transforming all functions of the state, such as administration, economy, and industry, into cyberspace, which increases cyber threats such as hacking and crime in virtual space as well as positive functions. In recent years, cyber terrorism has been increasing in various types of threats, such as industrial property theft, system paralysis, cyber warfare, and virtual currency theft, due to the expansion of the attack surface due to the expansion of the digital domain. The forms of attack are becoming more sophisticated. Now, the response to cyber terrorism should not be limited to the technological domain of information and communication, such as vaccine and defense program development, recovery system construction, and cyber forensic have to build Under this recognition, this paper aims to respond to cyber terrorism with strategies and tasks. First, unification of cyber terrorism response system and strengthening information sharing among response organizations through the enactment of the 'Framework Act on Cyber terrorism' in terms of laws and institutions. Second, cyber security experts Third, raising cyber security awareness and strengthening practice Fourth, establishing a cyber security inspection system and backup system Fifth, suggesting an AI-dedicated department and enactment of AI-related laws to actively respond to new vulnerable factors caused by the development of artificial intelligence technology.

The article provides a rationale for the practicality and features of using classic basic survival analysis methods for evaluating the effectiveness of financial monitoring and cyber security systems. The need to study this problem is due to the inability of modern systems of financial monitoring and cyber security at the state level to counteract various types of threats, especially in martial law conditions and the decline of economic growth. It is proposed to determine the effectiveness level of financial monitoring and cyber security systems using an integral indicator, the calculation of which is based on two composite indicators – the critical index of the cyber security system development level and the system development level essential index, which is countering the criminal proceeds legalization. Five qualitative levels of financial monitoring and cyber security systems effectiveness are distinguished. The survival function is interpreted in terms of the subject area. In terms of survival analysis, a level's change of the financial monitoring and cyber security systems integral indicator or the impossibility of its calculation due to the unavailability of statistical data is chosen as a critical event considered as the "death" of the system. The expediency of using three primary methods – the method of life table analysis, the Kaplan–Meier method and Cox regression – for evaluating the effectiveness of financial monitoring and cyber security systems is substantiated. The main arguments in favour of practicality were the possibility of using censored data, which is especially relevant in the absence of the necessary statistical information; the ability of survival analysis methods not only to study the effectiveness of financial monitoring and cyber security systems in time's periods but also to assess the factors that influence it; availability of separate survival analysis modules in data analysis computer programs.

With the increasing use of artificial intelligence (AI) models, more attention is being paid to issues of trust and security in AI systems against various types of threats (evasion attacks, poisoning, membership inference, etc.). In this work, we focus on the task of graph node classification, highlighting it as one of the most complex. To the best of our knowledge, this is the first study exploring the relationship between defense methods for AI models against different types of threats on graph data. Our experiments are conducted on citation and purchase graph datasets. We demonstrate that, in general, it is not advisable to simply combine defense methods for different types of threats, as this can lead to severe negative consequences, including a complete loss of model effectiveness. Furthermore, we provide theoretical proof of the contradiction between defense methods against poisoning attacks on graphs and adversarial training.

Privacy preserving rule-based classifier using modified artificial bee colony algorithm

The article is devoted to the study of the use of machine learning for the analysis of cyber attacks. The study examines Random Forest, SVM and Logistic Regression algorithms, which successfully cope with the tasks of detecting anomalies and minimizing false positives. Adapting models to work with unbalanced data, such as using LabelEncoder for categorical features and StandardScaler for data standardization, has significantly improved their performance. Based on the analysis of data from the «Real-Time Internet of Things (RT-IoT 2022)» set, the results of the accuracy and stability of the models are presented. The main focus is on protecting against cyber threats, including information leaks, DDoS attacks, and other types of threats. An analysis of various machine learning algorithms for cyberattack research has shown significant results. Random Forest has demonstrated the highest accuracy – 99,86%, providing high stability and efficiency in classifying various types of threats. SVM showed an accuracy of 99,29%, coping with most complex classes. Logistic Regression showed satisfactory results with an accuracy of 97,71%, although in some rare cases the accuracy was lower. Thus, Random Forest and SVM have demonstrated the best performance for security and cyberattack analysis tasks in digital systems, providing high accuracy and reliability. In the future, it is planned to introduce more sophisticated methods, such as deep learning, to more accurately identify and analyze threats.

Data mining and machine learning (ML) methods are used more than ever in cyber security. The use of machine learning (ML) is one of the potential solutions that may be successful against zero-day attacks, starting with categorising IP traffic and filtering harmful traffic for intrusion detection. In this field, certain published systematic reviews were taken into consideration. Recent systematic reviews may incorporate older and more recent works in the topic of investigation.. Both security professionals and hackers use data mining capabilities. Applications for data mining may be used to analyze programme activity, surfing patterns, and other factors to identify potential cyber-attacks in the future. The new study uses statistical traffic features, ML, and data mining approaches. This research performs a concentrated literature review on machine learning and its usage in cyber analytics for email filtering, traffic categorization, and intrusion detection. Each approach was identified, and a summary was provided based on the relevancy and quantity of citations. Some well-known datasets are also discussed since they are a crucial component of ML techniques. On when to utilize a certain algorithm is also offered some advice. Four ML algorithms have been evaluated on MODBUS data gathered from a gas pipeline. Using ML algorithms, other assaults have been categorized, and then the effectiveness of each approach has been evaluated. This study demonstrates the use of ML and data mining for threat research and detection, focusing on malware detection with high accuracy and short detection times.

With the rapid development of computer technology and the popularity of the network, database scale, scope and depth of the constantly expanding, which has accumulated vast amounts of different forms of stored data. The use of data mining technology can access valuable information from a lot of data. Privacy preserving has been one of the greater concerns in data mining. Privacy preserving data mining has a rapid development in a short year. But it still faces many challenges in the future. A number of methods and techniques have been developed for privacy preserving data mining. This paper analyzed the representative techniques for privacy preservation. Finally the present problems and directions for future research are discussed.

Data stream mining is a critical process utilized by organizations to derive insights from real-time data. Consequently, preserving the privacy of sensitive information while maintaining high accuracy remains a persistent challenge. Privacy-preserving data mining techniques modify data to increase privacy, a process that invariably decreases the accuracy of data mining algorithms. Though different techniques have been proposed to preserve privacy, there is a lack of well-formulated frameworks to optimize the trade-off between accuracy and privacy. This paper introduces a novel Accuracy-Privacy Optimization Framework (APOF) that allows users to define privacy requirements and predicts achievable accuracy levels, enabling fine-tuning of this balance. The logistic cumulative noise addition was used as the data perturbation method that has experimentally shown better performance and Hoeffding trees as the classifier. Additionally, a data fitting module using kernel regression is integrated, a unique approach that predicts accuracy levels based on user-defined privacy thresholds. Experimental results show that the proposed framework archives an optimal privacy level above 97% while minimising the accuracy loss across various datasets. By addressing critical gaps in privacy-preserving data mining, this study offers significant contributions to real-world applications, facilitating secure and efficient data utilization in dynamic environments.

With the incredible and powerful development of telecommunications net-works that we are witnessing in the third decade of the 21st century, international cyber-terrorism is also becoming more widespread. As a result of this phenome-non, individuals or entire international terrorist groups and organizations seek, thanks to the anonymity provided to them by cyberspace, to carry out various types of threats without any threat of identifying these criminals, their possible capture, or even physical elimination, as this happens in cases of elimination of real, not virtual, terrorist attacks. Today, international terrorist groups are increasingly using such tools to carry out attacks as DoS and DDoS attacks - denial of service, as well as other criminal methods, including phishing, online fraud, etc. Currently, international cyberterrorism poses a serious threat not only to the economy of the entire world community, but is also dangerous for various critical infrastructure facilities. In this regard, cyberterrorism has the highest level of threat to national security compared to other possible attacks by international terrorists. In this regard, the author proposes a set of measures that must be taken to prevent attacks by international cyberterrorists.

The goal of privacy preserving data mining is to develop accurate models without access to precise information in individual data records, thus finessing the conflict between privacy and data mining. In this talk, I will give an introduction to the techniques underlying privacy preserving data mining, and then discuss several application domains. In particular, recent events have led to an increased interest in applying data mining toward security related problems, leading to interesting technical challenges at the intersection of privacy, security and data mining.KeywordsArtificial IntelligenceData StructureData MiningInformation TheoryData RecordThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

A number of privacy preserving techniques have been proposed recently in data mining. In this paper, we provide a review of the state-of-the-art methods for privacy preserving data mining. and discuss methods for randomization, secure multipart computation, and so on. We also make a classification for the privacy preserving data mining technologies, and analyze some works in this field, such as data distortion method for achieving privacy preserving association rule mining. Detailed evaluation criteria of privacy preserving algorithm were illustrated, which include algorithm performance, data utility, and privacy protection degree. Finally, the development of privacy preserving data mining for further directions is given.