Threat Hunting Using a Machine LearningApproach
Yash Shukla · NORMA · 2020
The past few years have witnessed an increase in data breaches and attacks that leverage infrastructure misconfigurations. As a result, companies have to bear huge amounts of financial loss. In some cases, business information and personally identifiable information is also compromised. These threats can be detected at an early stage using proactive defence approaches with the help of experienced security practitioners. Traditionally, this involves manual analysis of logs and pcap files. Threat hunting reveals the adversaries as soon as they initiate an attack on an infrastructure. But network devices generate a vast number of logs, thus to analyse them it becomes a tedious task. To tackle this problem, this process can be automated by incorporating machine learning algorithms. This research has been conducted by applying machine learning algorithms such as Naive Bayes, SVM,Logistic Regression along with ensemble techniques like voting classifier, which can identify threats from log files based on conditions related to attacks and business logic. The accuracy rate of the experiments conducted is higher compared to traditional approaches. It was observed that machine learning can achieve higher accuracy in a limited time frame.