The ever-increasing number of multi-vector cyberattacks has become a concern for all levels of organizations. Attackers are infecting Internet-enabled devices and exploiting them to carry out attacks. These devices are unwittingly becoming part of carrying out cyberattacks. Many studies have proposed machine learning–based promising solutions to stamp out cyberattacks preemptively. We review the machine learning techniques and highlight some promising solutions in recent studies. This study provides the advantage of experimenting with the developed solutions on modern datasets. This survey aims to provide an insightful organization of current developments in cybersecurity datasets and give suggestions for further research. We identified the most frightful cyberattacks and suitable datasets having records related to the attack. This paper discusses modern datasets such as CICIDS2017, CSE-CIC-IDS-2018, CIC-DDoS2019, UNSW-NB15, UNSW-TonIOT, UNSW-BotIoT, DoHBrw2020, and ISCX-URL-2016, which include records of recent sophisticated cyberattacks. This paper will focus on these modern datasets, retrieve detailed knowledge, and experiment with the most commonly used machine learning algorithms. We identify datasets as a significant centric topic that can be addressed with innovative machine learning approaches and solutions to defend against cyberattacks.
KoliasCKambourakisGStavrouA, et al. DDoS in the IoT: Mirai and other botnets. Computer2017; 50: 80–84.
2.
MargolisJOhTTJadhavS, et al. An in-depth analysis of the Mirai botnet. In: 2017 international conference on software security and assurance (ICSSA), Altoona, PA, 24–25 July 2017, pp. 6–12. New York: IEEE.
3.
AskarifarSRahmanNAOsmanH.A review of latest WannaCry ransomware: actions and preventions. J Eng Sci Technol2018; 13: 24–33.
4.
FayiSY.What Petya/NotPetya ransomware is and what its remidiations are. In: LatifiS (ed.) Information technology—new generations. Cham: Springer, 2018, pp. 93–100.
5.
MooreKLBihlTJBauerKWJr, et al. Feature extraction and feature selection for classifying cyber traffic threats. J Defen Model Simul2017; 14: 217–231.
6.
PriyadarshiniRKumar BarikRDubeyH.Fog-SDN: a light mitigation scheme for DdoS attack in fog computing framework. Int J Commun Syst2020; 33: e4389.
7.
GarreJTPérezMGRuiz-MartínezA.A novel Machine Learning-based approach for the detection of SSH botnet infection. Future Gener Comp Sy2021; 115: 387–396.
8.
ur RehmanSKhaliqMImtiazSI, et al. Diddos: an approach for detection and identification of distributed denial of service (DDoS) cyberattacks using gated recurrent units (GRU). Future Gener Comp Sy2021; 118: 453–466.
9.
ZhangHLiYLvZ, et al. A real-time and ubiquitous network attack detection based on deep belief network and support vector machine. IEEE/CAA J Automatica Sinica2020; 7: 790–799.
10.
RaviNShalinieSM.Semisupervised-learning-based security to detect and mitigate intrusions in IoT network. IEEE Internet Things2020; 7: 11041–11052.
11.
RoopakMTianGYChambersJ.Multi-objective-based feature selection for DDoS attack detection in IoT networks. IET Net2020; 9: 120–127.
12.
DwivediSVardhanMTripathiS.Defense against distributed DoS attack detection by using intelligent evolutionary algorithm. Int J Comput Appl2022; 44: 219–229.
SharafaldinILashkariAHGhorbaniAA.Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp2018; 1: 108–116.
22.
KanimozhiVJacobTP. Artificial intelligence based network intrusion detection with hyper-parameter optimization tuning on the realistic cyber dataset CSE-CIC-IDS2018 using cloud computing. In: 2019 international conference on communication and signal processing (ICCSP), Chennai, India, 4–6 April 2019, pp. 0033–0036. New York: IEEE.
23.
ThakkarALohiyaR.A review of the advancement in intrusion detection datasets. Procedia Comput Sci2020; 167: 636–645.
24.
SharafaldinILashkariAHHakakS, et al. Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy. In: 2019 international Carnahan conference on security technology (ICCST), Chennai, India, 1–3 October 2019, pp. 1–8. New York: IEEE.
25.
MoustafaNSlayJ. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: 2015 military communications and information systems conference (MilCIS), Canberra, ACT, Australia, 10–12 November 2015, pp. 1–6. New York: IEEE.
KoroniotisNMoustafaNSitnikovaE, et al. Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-Iot dataset. Future Gener Comp Sy2019; 100: 779–796.
28.
MoustafaN.A new distributed architecture for evaluating AI-based security systems at the edge: network TON_IoT datasets. Sustain Cities Soc2021; 72: 102994.
29.
MontazeriShatooriMDavidsonLKaurG, et al. Detection of DoH tunnels using time-series classification of encrypted traffic. In: 2020 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech), Calgary, AB, Canada, 17–22August2020, pp. 63–70. New York: IEEE.
30.
MamunMSRathoreMALashkariAH, et al. Detecting malicious URLs using lexical analysis. In: International conference on network and system security, Taipei, 28–30 September 2016, pp. 467–482. Cham: Springer.
31.
Al TobiAMDuncanI. KDD 1999 generation faults: a review and analysis. J Cyber Sec Technol2018; 2: 164–200.
32.
TavallaeeMBagheriELuW, et al. A detailed analysis of the KDD CUP 99 data set. In: 2009 IEEE symposium on computational intelligence for security and defense applications, Ottawa, ON, Canada, 8–10 July 2009, pp. 1–6. New York: IEEE.
33.
DhanabalLShantharajahSP.A study on NSL-KDD dataset for intrusion detection system based on classification algorithms. Int J Adv Res Comput Commun Eng2015; 4: 446–452.
34.
ProtićDD.Review of KDD Cup ‘99, NSL-KDD and Kyoto 2006+ datasets. Vojnotehnički glasnik/Milit Tech Courier2018; 66: 580–596.
35.
NajafabadiMMKhoshgoftaarTMSeliyaN.Evaluating feature selection methods for network intrusion detection with Kyoto data. Int J Reliab Qual Safe Eng2016; 23: 1650001.
36.
SangsterBO’ConnorTJCookT, et al. Toward instrumenting network warfare competitions to generate labeled datasets. In: CSET’09, 10August2009, https://dl.acm.org/doi/10.5555/1855481.1855490
37.
KoliasCKambourakisGStavrouA, et al. Intrusion detection in 802.11 networks: empirical evaluation of threats and a public dataset. IEEE Commun Surv Tut2015; 18: 184–208.
38.
AhmadZShahid KhanAWai ShiangC, et al. Network intrusion detection system: a systematic study of machine learning and deep learning approaches. T Emerg Telecommun T2021; 32: e4150.
39.
UgtakhbayarNUsukhbayarBBaigaltugsS. A hybrid model for anomaly-based intrusion detection system. In: PanJ-SLiJTsaiP-W, et al. (eds) Advances in intelligent information hiding and multimedia signal processing. Singapore: Springer, 2020, pp. 419–431.
40.
HaqueAAyyarAVSinghS.A meta data mining framework for botnet analysis. Int J Comput Appl2019; 41: 392–399.
41.
SalimMMRathoreSParkJH.Distributed denial of service attacks and its defenses in IoT: a survey. J Supercomput2020; 76: 5320–5363.
42.
DasguptaDAkhtarZSenS.Machine learning in cybersecurity: a comprehensive survey. J Defen Model Simul2022; 19: 57–106.
TjhaiGCPapadakiMFurnellSM, et al. Investigating the problem of IDS false alarms: an experimental study using Snort. In: IFIP international information security conference, Milano, 7–10 September 2008, pp. 253–267. Boston, MA: Springer.
