A selective ensemble model for cognitive cybersecurity analysis. (1st November 2021)

• Record Type: Journal Article
• Authors: Jiang, Yuning; Atif, Yacine
• Is Part Of: Journal of network and computer applications. Volume 193(2021)
• Publication Date: 2021-11-01
• Subjects: Information security -- Vulnerability analysis -- Data correlation -- Machine learning -- Ensemble -- Data mining -- Database management; Microcomputers -- Periodicals; Computer networks -- Periodicals; Application software -- Periodicals; Micro-ordinateurs -- Périodiques; Réseaux d'ordinateurs -- Périodiques; Logiciels d'application -- Périodiques; Application software; Computer networks; Microcomputers; Periodicals; 004.05; 004
• DOI: 10.1016/j.jnca.2021.103210
• Languages: English
• ISSNs: 1084-8045

Abstract

Abstract: Dynamic data-driven vulnerability assessments face massive heterogeneous data contained in, and produced by SOCs (Security Operations Centres). Manual vulnerability assessment practices result in inaccurate data and induce complex analytical reasoning. Contemporary security repositories' diversity, incompleteness and redundancy contribute to such security concerns. These issues are typical characteristics of public and manufacturer vulnerability reports, which exacerbate direct analysis to root out security deficiencies. Recent advances in machine learning techniques promise novel approaches to overcome these notorious diversity and incompleteness issues across massively increasing vulnerability reports corpora. Yet, these techniques themselves exhibit varying degrees of performance as a result of their diverse methods. We propose a cognitive cybersecurity approach that empowers human cognitive capital along two dimensions. We first resolve conflicting vulnerability reports and preprocess embedded security indicators into reliable data sets. Then, we use these data sets as a base for our proposed ensemble meta-classifier methods that fuse machine learning techniques to improve the predictive accuracy over individual machine learning algorithms. The application and implication of this methodology in the context of vulnerability analysis of computer systems are yet to unfold the full extent of its potential. The proposed cognitive security methodology in this paper is shown to improve performances when addressing the above-mentioned incompleteness and diversity issues across cybersecurity alert repositories. The experimental analysis conducted on actual cybersecurity data sources reveals interesting tradeoffs of our proposed selective ensemble methodology, to infer patterns of computer system vulnerabilities. Highlights: Multiple online and heterogeneous cybersecurity repositories are synchronously integrated. An ensemble method that consists of a pipeline of machine-learning algorithms for modelling and optimising predictive analytics in cybersecurity. Case studies of machine-learning augmented methods for diverse cybersecurity mission targets. A cognitive cybersecurity approach that asserts a collaboration framework between machine learning techniques and human intelligence.