Desarrollo de un modelo clasificador de malware con algoritmos de aprendizaje automático.

Abstract

The technologies, processes, methodologies, tools and tactics contemplated by defense in depth (DiD) and specifically in its two layers of network security and perimeter security, require skills to timely control periodic cybercrime threats in an increasingly broad landscape of vulnerabilities and attacks. Just considering the DoS and DDoS distributed denial of service attacks, which are characterized in this project, results in the end with a dataset of 10 different families or classes of DoS and DDoS attacks, which together with benign traffic is sought to detect and classify into eleven 11 multiclasses by using techniques based on supervised machine learning (Machine Learning). The labeled dataset, is a collection of the years 2017, 2018 and 2019, which contains the attributes of the captured network traffic and is used with CICFlowMeter provided by researchers from Canadian Institute for Cybersecurity of University of New Brunswick CIC - UNB, and whose data is suitable to be the input data for the algorithms and machine learning techniques to be implemented in this project. A multiclass detector and classifier model was designed thanks to the learning of 20 different algorithms, trained and applying cross validation to know their performance and behavior, discarding most of them, and settling on only five algorithms: Random Forests RF, Extreme Tree ET, Decision Tree DT and 2 different ways of applying the novel XGBoost. Thus, data that is not part of the training set, has not been seen, and has real labels given, are evaluated by means of metrics and performance results, to obtain the best of the five. The results obtained from the best of the five learning algorithms, corresponds to the Random Forests. Thus, we have managed to obtain in our final model design a performance, very good judging the reader himself. First with the normal test data set 10% of the total set, for a total of 1'359,628 network traffic flows: accuracy[f1- socre] of 1.00; macro avg[precision] 0.98; macro avg[recall] 0.99; macro avg[f1- socre] 0.98; weighted avg[precision] 1.00; weighted avg[recall] 1.00; weighted avg[f1-socre] 1.00. With a logistic loss lloss_RF of 0.0656859. Hamming loss of 0.0045166.