Preface |
|
xi | |
|
1 Why Machine Learning and Security? |
|
|
1 | (24) |
|
|
3 | (4) |
|
The Cyber Attacker's Economy |
|
|
7 | (1) |
|
A Marketplace for Hacking Skills |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
What Is Machine Learning? |
|
|
9 | (1) |
|
What Machine Learning Is Not |
|
|
10 | (1) |
|
Adversaries Using Machine Learning |
|
|
11 | (1) |
|
Real-World Uses of Machine Learning in Security |
|
|
12 | (2) |
|
Spam Fighting: An Iterative Approach |
|
|
14 | (9) |
|
Limitations of Machine Learning in Security |
|
|
23 | (2) |
|
2 Classifying and Clustering |
|
|
25 | (54) |
|
Machine Learning: Problems and Approaches |
|
|
25 | (2) |
|
Machine Learning in Practice: A Worked Example |
|
|
27 | (5) |
|
Training Algorithms to Learn |
|
|
32 | (1) |
|
|
33 | (2) |
|
|
35 | (1) |
|
|
36 | (4) |
|
Supervised Classification Algorithms |
|
|
40 | (1) |
|
|
40 | (2) |
|
|
42 | (3) |
|
|
45 | (2) |
|
|
47 | (2) |
|
|
49 | (3) |
|
|
52 | (1) |
|
|
53 | (2) |
|
Practical Considerations in Classification |
|
|
55 | (1) |
|
|
55 | (1) |
|
Training Data Construction |
|
|
56 | (3) |
|
|
59 | (2) |
|
Overfitting and Underfitting |
|
|
61 | (1) |
|
Choosing Thresholds and Comparing Models |
|
|
62 | (3) |
|
|
65 | (1) |
|
|
65 | (10) |
|
Evaluating Clustering Results |
|
|
75 | (2) |
|
|
77 | (2) |
|
|
79 | (46) |
|
When to Use Anomaly Detection Versus Supervised Learning |
|
|
80 | (1) |
|
Intrusion Detection with Heuristics |
|
|
81 | (1) |
|
|
82 | (3) |
|
Feature Engineering for Anomaly Detection |
|
|
85 | (1) |
|
|
85 | (4) |
|
Network Intrusion Detection |
|
|
89 | (3) |
|
Web Application Intrusion Detection |
|
|
92 | (1) |
|
|
93 | (1) |
|
Anomaly Detection with Data and Algorithms |
|
|
93 | (2) |
|
Forecasting (Supervised Machine Learning) |
|
|
95 | (11) |
|
|
106 | (1) |
|
|
107 | (5) |
|
Unsupervised Machine Learning Algorithms |
|
|
112 | (4) |
|
|
116 | (2) |
|
|
118 | (1) |
|
Challenges of Using Machine Learning in Anomaly Detection |
|
|
119 | (1) |
|
|
120 | (1) |
|
Practical System Design Concerns |
|
|
121 | (1) |
|
Optimizing for Explainability |
|
|
121 | (2) |
|
Maintainability of Anomaly Detection Systems |
|
|
123 | (1) |
|
Integrating Human Feedback |
|
|
123 | (1) |
|
Mitigating Adversarial Effects |
|
|
123 | (1) |
|
|
124 | (1) |
|
|
125 | (56) |
|
|
126 | (2) |
|
Defining Malware Classification |
|
|
128 | (3) |
|
Malware: Behind the Scenes |
|
|
131 | (14) |
|
|
145 | (1) |
|
|
146 | (1) |
|
|
147 | (24) |
|
|
171 | (3) |
|
From Features to Classification |
|
|
174 | (4) |
|
How to Get Malware Samples and Labels |
|
|
178 | (1) |
|
|
179 | (2) |
|
5 Network Traffic Analysis |
|
|
181 | (54) |
|
Theory of Network Defense |
|
|
183 | (1) |
|
Access Control and Authentication |
|
|
183 | (1) |
|
|
184 | (1) |
|
Detecting In-Network Attackers |
|
|
185 | (1) |
|
|
185 | (1) |
|
|
186 | (1) |
|
|
186 | (1) |
|
Machine Learning and Network Security |
|
|
187 | (1) |
|
From Captures to Features |
|
|
187 | (6) |
|
|
193 | (4) |
|
|
197 | (6) |
|
Building a Predictive Model to Classify Network Attacks |
|
|
203 | (2) |
|
|
205 | (5) |
|
|
210 | (4) |
|
|
214 | (2) |
|
|
216 | (6) |
|
|
222 | (1) |
|
|
223 | (5) |
|
|
228 | (5) |
|
|
233 | (2) |
|
6 Protecting the Consumer Web |
|
|
235 | (40) |
|
Monetizing the Consumer Web |
|
|
236 | (1) |
|
Types of Abuse and the Data That Can Stop Them |
|
|
237 | (1) |
|
Authentication and Account Takeover |
|
|
237 | (6) |
|
|
243 | (5) |
|
|
248 | (3) |
|
|
251 | (5) |
|
Supervised Learning for Abuse Problems |
|
|
256 | (1) |
|
|
256 | (2) |
|
Cold Start Versus Warm Start |
|
|
258 | (1) |
|
False Positives and False Negatives |
|
|
258 | (1) |
|
|
259 | (1) |
|
|
259 | (1) |
|
|
260 | (1) |
|
Example: Clustering Spam Domains |
|
|
261 | (1) |
|
|
262 | (4) |
|
|
266 | (5) |
|
Further Directions in Clustering |
|
|
271 | (1) |
|
|
272 | (3) |
|
|
275 | (40) |
|
Defining Machine Learning System Maturity and Scalability |
|
|
275 | (2) |
|
What's Important for Security Machine Learning Systems? |
|
|
277 | (1) |
|
|
277 | (1) |
|
Problem: Bias in Datasets |
|
|
277 | (2) |
|
Problem: Label Inaccuracy |
|
|
279 | (1) |
|
|
279 | (1) |
|
|
280 | (1) |
|
|
281 | (3) |
|
|
284 | (1) |
|
Problem: Hyperparameter Optimization |
|
|
285 | (1) |
|
Solutions: Hyperparameter Optimization |
|
|
285 | (5) |
|
Feature: Feedback Loops, A/B Testing of Models |
|
|
290 | (3) |
|
Feature: Repeatable and Explainable Results |
|
|
293 | (4) |
|
|
297 | (1) |
|
Goal: Low Latency, High Scalability |
|
|
297 | (1) |
|
|
298 | (2) |
|
Horizontal Scaling with Distributed Computing Frameworks |
|
|
300 | (5) |
|
|
305 | (2) |
|
|
307 | (1) |
|
Problem: Checkpointing, Versioning, and Deploying Models |
|
|
307 | (2) |
|
Goal: Graceful Degradation |
|
|
309 | (1) |
|
Goal: Easily Tunable and Configurable |
|
|
309 | (1) |
|
|
310 | (2) |
|
|
312 | (1) |
|
Feature: Robustness in Adversarial Contexts |
|
|
312 | (1) |
|
Feature: Data Privacy Safeguards and Guarantees |
|
|
312 | (1) |
|
|
313 | (1) |
|
|
314 | (1) |
|
8 Adversarial Machine Learning |
|
|
315 | (28) |
|
|
316 | (1) |
|
The Importance of Adversarial ML |
|
|
317 | (1) |
|
Security Vulnerabilities in Machine Learning Algorithms |
|
|
318 | (2) |
|
|
320 | (2) |
|
Attack Technique: Model Poisoning |
|
|
322 | (3) |
|
Example: Binary Classifier Poisoning Attack |
|
|
325 | (5) |
|
|
330 | (1) |
|
Defense Against Poisoning Attacks |
|
|
331 | (2) |
|
Attack Technique: Evasion Attack |
|
|
333 | (1) |
|
Example: Binary Classifier Evasion Attack |
|
|
334 | (5) |
|
Defense Against Evasion Attacks |
|
|
339 | (1) |
|
|
340 | (3) |
A Supplemental Material for Chapter 2 |
|
343 | (8) |
B Integrating Open Source Intelligence |
|
351 | (4) |
Index |
|
355 | |