Utilising Flow Aggregation to Classify Benign Imitating Attacks.

Area of Science:

• Computer Science
• Cybersecurity
• Network Security

Background:

• Cyber-attacks are increasing in volume and sophistication, posing significant threats.
• Existing machine learning defenses struggle with attacks that imitate benign network traffic.
• Feature engineering is crucial for effective cyber-attack detection models.

Purpose of the Study:

• To introduce novel features for enhanced cyber-attack detection.
• To improve the classification of cyber-attacks that mimic benign behavior.
• To advance feature extraction techniques for complex cyber threats.

Main Methods:

• Developed new features through higher-level abstraction of network traffic.
• Implemented flow aggregation by grouping similar network flows.
• Evaluated feature performance using the CICIDS2017 dataset.

Main Results:

• The proposed features demonstrated validity and effectiveness in cyber-attack detection.
• The new features improved the ability to classify attacks mimicking benign traffic.
• Enhanced detection accuracy was achieved for complex cyber-attacks.

Conclusions:

• Flow aggregation offers a promising direction for cyber-attack feature extraction.
• The novel features significantly improve the accuracy of cyber-attack detection systems.
• This approach contributes to building more robust defenses against evolving cyber threats.