Enhancing Cybersecurity Postures Using Machine Learning

The increasing levels of sophistication in modern cyber adversaries have led to the identification of critical structural flaws in the conventional and rule-based security architectures. The inability of signature-based detection systems, which were traditionally viewed as pillars of enterprise security, to detect zero-day exploits and various forms of polymorphic threats and behavioural anomalies that have been embedded in the stream of otherwise legitimate network activities have become common place. The current paper presents an intelligent and self-evolutionary cybersecurity framework that is based on the machine learning principles and is designed to analyse high-frequency streams containing various forms of network activity data, system event data, and User Entity Behaviour Analytics in near real-time. The framework incorporates a complementary dual-layer modeling approach that is dedicated to the classification of well-established threat categories such as Distributed Denial of Service and SQL injection exploits, in addition to an unsupervised anomaly detection approach that can be utilized to identify statistically significant anomalies in the behaviour of the applications. The approach significantly reduces the levels of false positives and provides faster Mean Time to Respond, thus addressing the perpetual problem of alert fatigue in the Security Operations Centres. The framework is designed to seamlessly integrate with the conventional Security Information and Event Management ecosystem. As a result of the empirical validation of this solution against the UNSW-NB15 and CIC-IDS2017 benchmark datasets, the aggregate accuracy of detection was found to be 96.4%, affirming that this ML-based posture does, in fact, significantly enhance the capabilities of the organization to not only detect and neutralize APT attacks before significant damage is propagated.