Tackling imbalanced data in cybersecurity with transfer learning: a case with ROP payload detection

Cybersecurity

Research

Haizhou Wang¹  Peng Liu¹  Anoop Singhal² 

[1] College of Information Sciences and Technology, The Pennsylvania State University, State College, USA;The National Institute of Standards and Technology, Gaithersburg, USA;

关键词: Domain adaptation;    Return-oriented programming;    Imbalanced dataset;   

DOI  :  10.1186/s42400-022-00135-8

 received in 2022-06-28, accepted in 2022-12-22,  发布年份 2022

来源: Springer

【 摘 要 】

In recent years, deep learning gained proliferating popularity in the cybersecurity application domain, since when being compared to traditional machine learning methods, it usually involves less human efforts, produces better results, and provides better generalizability. However, the imbalanced data issue is very common in cybersecurity, which can substantially deteriorate the performance of the deep learning models. This paper introduces a transfer learning based method to tackle the imbalanced data issue in cybersecurity using return-oriented programming payload detection as a case study. We achieved 0.0290 average false positive rate, 0.9705 average F1 score and 0.9521 average detection rate on 3 different target domain programs using 2 different source domain programs, with 0 benign training data sample in the target domain. The performance improvement compared to the baseline is a trade-off between false positive rate and detection rate. Using our approach, the total number of false positives is reduced by 23.16%, and as a trade-off, the number of detected malicious samples decreases by 0.68%.

【 授权许可】

CC BY   
© The Author(s) 2023

【 图 表 】

41116_2022_35_Article_IEq315.gif

41116_2022_35_Article_IEq313.gif

41116_2022_35_Article_IEq311.gif

41116_2022_35_Article_IEq309.gif

41116_2022_35_Article_IEq307.gif

41116_2022_35_Article_IEq306.gif

41116_2022_35_Article_IEq305.gif

41116_2022_35_Article_IEq304.gif

41116_2022_35_Article_IEq303.gif

41116_2022_35_Article_IEq302.gif

41116_2022_35_Article_IEq301.gif

41116_2022_35_Article_IEq300.gif

41116_2022_35_Article_IEq299.gif

41116_2022_35_Article_IEq296.gif

41116_2022_35_Article_IEq295.gif

Fig. 3

Fig. 2

41116_2022_35_Article_IEq287.gif

41116_2022_35_Article_IEq286.gif

Fig. 1

41116_2022_35_Article_IEq283.gif

41116_2022_35_Article_IEq281.gif