Cybercrime Detection Approaches using Machine Learning and Deep Learning Techniques
TL;DR
Results highlight that the ensemble tree based methods are still highly effective for the structured network traffic classification cases, and a Deep learning-based approach presents an even more competitive solution with the task of feature selection through raw data, which opens doors of opportunity to extract features by various means from raw data for these cases.
Abstract
As a technology that connects even more systems and services to the Internet with each passing day, cybercrime has grown out of control globally. Significant problems with traditional IDSs have been uncovered when they are exposed to new attack vectors and advanced evasion strategies not contained in their rule sets and/or signature databases. This paper contains comprehensive research and empirical analysis of 9 machine learning and deep learning algorithms for binary classification of network traffics into normal or malicious network traffic. The benchmark dataset used in this study is the KDD Cup 1999 dataset, which consists of around 494,021 network connection records derived from a relatively large network, characterized with 41 different features of continuous, discrete and categorical attribute types. Its performance was compared with five classical machine learning algorithms, namely decision tree, random forest, support vector machine with a linear kernel, K-nearest neighbours and gaussian naive bayes. Furthermore, four deep learning architectures were studied, a fully connected Artificial Neural Network, a one dimensional Convolutional Neural Network (CNN), a Long Short-Term Memory (LSTM) recurrent network, and an Autoencoder based model for anomaly detection (AD). These models were thoroughly validated with accuracy, precision, recall, F1 score and ROC-AUC on an 80-20 stratified train test partition. Experimental results showed that the ensemble of Random Forest classifiers has the best overall performance with an overall accuracy of 99.98% and a near-perfect value of ROC-AUC (99.99%). Decision Tree obtained a value of 99.97% in terms of accuracy and a near-perfect value of 99.98% for the ROC-AUC measure. The best deep learning models were the ANN (accuracy of 99.95%) and the LSTM (accuracy of 99.95%) with their nearest architectures, followed by the unsupervised model of Autoencoder (accuracy of 98.94%) with the reconstruction error thresholding. The results highlight that the ensemble tree based methods are still highly effective for the structured network traffic classification cases, and a Deep learning-based approach presents an even more competitive solution with the task of feature selection through raw data, which opens doors of opportunity to extract features by various means from raw data for these cases. In addition, the model was deployed practically with a RESTful API built using FastAPI, allowing for the real-time analysis of live traffic with the trained models.