Review: machine learning techniques applied to cybersecurity

  • Javier Martínez Torres
  • Carla Iglesias Comesaña
  • Paulino J. García-Nieto
Original Article


Machine learning techniques are a set of mathematical models to solve high non-linearity problems of different topics: prediction, classification, data association, data conceptualization. In this work, the authors review the applications of machine learning techniques in the field of cybersecurity describing before the different classifications of the models based on (1) their structure, network-based or not, (2) their learning process, supervised or unsupervised and (3) their complexity. All the capabilities of machine learning techniques are to be regarded, but authors focus on prediction and classification, highlighting the possibilities of improving the models in order to minimize the error rates in the applications developed and available in the literature. This work presents the importance of different error criteria as the confusion matrix or mean absolute error in classification problems, and relative error in regression problems. Furthermore, special attention is paid to the application of the models in this review work. There are a wide variety of possibilities, applying these models to intrusion detection, or to detection and classification of attacks, to name a few. However, other important and innovative applications in the field of cybersecurity are presented. This work should serve as a guide for new researchers and those who want to immerse themselves in the field of machine learning techniques within cybersecurity.


Cybersecurity Detection systems Internet threats Machine learning Security 



C. Iglesias acknowledges the support of the Spanish Ministry of Education, Culture and Sport for FPU Grant number 12/02283. J. Martinez acknowledges the support of the Spanish Ministry of Education for Grant project ID TIN2016-76770-R.


  1. 1.
    International Telecommunication Union (2014) The world in 2014: ICT Facts and figures. Technical reportGoogle Scholar
  2. 2.
    Klimburg A (ed) (2012) National cyber security framework manual. NATO CCD COE PublicationGoogle Scholar
  3. 3.
    Kolter JZ, Maloof MA (2006) Learning to detect and classify malicious executables in the wild. J Mach Learn Res 7:2721–2744MathSciNetzbMATHGoogle Scholar
  4. 4.
    Almomani A, Altaher A, Ramadass S (2012) Application of adaptive neuro-fuzzy inference system for information security. J Comput Sci 8(6):983–986CrossRefGoogle Scholar
  5. 5.
    Bauer JM, van Eeten MJG (2009) Cybersecurity: stakeholder incentives, externalities, and policy options. Telecommun Policy 33(10–11):706–719CrossRefGoogle Scholar
  6. 6.
    Vázquez C (2014) Auditing using vulnerability tools to identify today’s threats business performance. SANS Institute, FredericksburgGoogle Scholar
  7. 7.
    Parise Furfaro A (2017) Using virtual environments for the assessment of cybersecurity issues in IoT scenarios. Simul Model Pract Theory 73:43–54CrossRefGoogle Scholar
  8. 8.
    Hashemi Khorshidpour T (2017) Domain invariant feature extraction against evasion attack. Int J Mach Learn Cybern 9:1–12Google Scholar
  9. 9.
    Kumar VA, Pandey KK, Punia DK (2014) Cyber security threats in the power sector: Need for a domain specific regulatory framework in India. Energy Policy 65:126–133CrossRefGoogle Scholar
  10. 10.
    North Atlantic Treaty Organization (NATO) (2008) Bucharest summit declaration. Issued by the Heads of State and Government participating in the meeting of the North Atlantic Council in Bucharest on 3 April 2008Google Scholar
  11. 11.
    Barat M, Bogdan D, P, Gavrilut DT (2013) An automatic updating perceptron-based system for malware detection. In: IEEE 2013 15th international symposium on symbolic and numeric algorithms for scientific computing, pp 303–307Google Scholar
  12. 12.
    Bauer JM, Van Eeten M, Chattopadhyay T, Wu Y (2008) Financial implications of network security: malware and spam. Technical report, report for the international telecommunication union (ITU), Geneva (Switzerland)Google Scholar
  13. 13.
    International Organization for Standardization (2012) ISO/IEC 27032:2012. Information technology—Security techniques—Guidelines for cybersecurityGoogle Scholar
  14. 14.
    Fischer EA (2005) Creating a national framework for cybersecurity: an analysis of issues and options. Technical report. Congressional Research ServiceGoogle Scholar
  15. 15.
    The Open Web Application Security Project (OWASP) (2018)
  16. 16.
    The Open Web Application Security Project (2013) OWASP Top 10—the ten most critical web application security risks. The OWASP FoundationGoogle Scholar
  17. 17.
    Microsoft Security Development Lifecycle (2018)
  18. 18.
    Vatamanu C, Gavriluţ D, Benchea R-M (2013) Building a practical and reliable classifier for malware detection. J Comput Virol Hacking Tech 9(4):205–214CrossRefGoogle Scholar
  19. 19.
    Gavrilut D, Benchea R, Vatamanu C (September 2012) Optimized zero false positives perceptron training for malware detection. In: IEEE 2012 14th international symposium on symbolic and numeric algorithms for scientific computing, pp 247–253Google Scholar
  20. 20.
    Gavrilut D, Benchea R, Vatamanu C (2012) Practical optimizations for perceptron algorithms in large malware dataset. In: IEEE 2012 14th international symposium on symbolic and numeric algorithms for scientific computing, pp 240–246Google Scholar
  21. 21.
    Singh K, Guntuku SC, Thakur A, Hota C (2014) Big data analytics framework for peer-to-peer botnet detection using random forests. Inf Sci 278:488–497CrossRefGoogle Scholar
  22. 22.
    Goseva-Popstojanova K, Anastasovski G, Dimitrijevikj A, Pantev R, Miller B (2014) Characterization and classification of malicious web traffic. Comput Secur 42:92–115CrossRefGoogle Scholar
  23. 23.
    Purkait S (2012) Phishing counter measures and their effectiveness: literature review. Inf Manag Comput Secur 20(5):382–420CrossRefGoogle Scholar
  24. 24.
    Ceesay EN (2008) Mitigating phishing attacks: a detection, response and evaluation framework. Ph.D. thesis, University of CaliforniaGoogle Scholar
  25. 25.
    Nappa D, Wang X, Abu-Nimeh S, Nair S (2007) A comparison of machine learning techniques for phishing detection. In: Proceedings of the anti-phishing working groups 2nd annual eCrime researchers summit on—eCrime ’07, pp 60–69Google Scholar
  26. 26.
    MacQueen JB (1967) Some methods for classification and analysis of multivariate observations. In: pp 281–297Google Scholar
  27. 27.
    Kohonen T (1982) Self-organizating formation of topologically correct feature maps. Biol Cybern 43:59–69MathSciNetzbMATHCrossRefGoogle Scholar
  28. 28.
    Gordon AD (1992) Hierarchical classification. World Scientific Press, SingaporeGoogle Scholar
  29. 29.
    Albayrak S, Amasyali F (2003) Fuzzy c-means clustering on medical diagnostic systems. In: International twelfth Turkish symposium on artificial intelligence and neural networks (TAINN), pp 1–3Google Scholar
  30. 30.
    Bradley PS, Fayad UM (1998) Refining initial points for k-means clustering. In: Proceedings of the 15th conference on machine learning, Wisconsin, pp 91–99Google Scholar
  31. 31.
    Haykin S (1999) Neural netowrks. A comprehensive foundation. Prentice Hall, Upper Saddle RiverzbMATHGoogle Scholar
  32. 32.
    Quinlan JR (1986) Induction on decision trees. Mach Learn 1:81–106Google Scholar
  33. 33.
    Quinlan JR (1993) C4.5: programas for machine learning. Morgan Kaufmann, BurlingtonGoogle Scholar
  34. 34.
    Breiman L, Friedman J (1984) Classification and regression trees. Wadsworth, BelmontzbMATHGoogle Scholar
  35. 35.
    Cherkassky V, Mulier F (1998) Learning from data: concepts, theory and methods. Wiley, BerlinzbMATHGoogle Scholar
  36. 36.
    Vorobeva A (2017) Influence of features discretization on accuracy of random forest classifier for web user identification. In: Conference of open innovation association, FRUCTGoogle Scholar
  37. 37.
    Miller S, Busby-Earle C (2017) Multi-perspective machine learning a classifier ensemble method for intrusion detection. In: ICMLSC ’17 proceedings of the 2017 international conference on machine learning and soft computing, pp 7–12Google Scholar
  38. 38.
    He S, Lee G, Han S, Whinston A (2016) How would information disclosure influence organizations’ outbound spam volume? Evidence from a field experiment. J Cybersecur 2(1):99–118CrossRefGoogle Scholar
  39. 39.
    Vapnik V (1982) Estimation of dependences based on empirical data. Springer, BerlinzbMATHGoogle Scholar
  40. 40.
    Drucker H, Burges C, Kaufman L, Smola A, Vapnik V (1997) Support vector regression machines. MIT Press, CambridgeGoogle Scholar
  41. 41.
    Osuna E, Freund R, Girosi F (1997) An improved training algorithm for support vector machines, In: Proceedings of the 1997 IEEE signal processing society workshop, Amelia Island, Florida, USA, pp 1–10Google Scholar
  42. 42.
    Joachims T (1999) Machine large-scale SVM learning practical. MIT Press, CambridgeGoogle Scholar
  43. 43.
    Kyriakopoulos Ghanem A (2017) Support vector machine for network intrusion and cyber-attack detection. Sensor Signal Processing for Defence Conference (SSPD2017) 38–41Google Scholar
  44. 44.
    Vapnik V (1998) Statistical learning theory. Wiley, BerlinzbMATHGoogle Scholar
  45. 45.
    MacCulloch WS, Pitts WS (1943) A logical calculus of the ideas immanent in nervous activity. Bull Math Biophys 5:115–133MathSciNetzbMATHCrossRefGoogle Scholar
  46. 46.
    Dua S, Du X (2011) Data mining and machine learning in cybersecurity. Auerbach Publications, Taylor & Francis Group, Boca Raton, FL, USAGoogle Scholar
  47. 47.
    Battiti R (1992) First and second-order methods for learning: between steepset descent and newton method. Neural Comput 4:141–166CrossRefGoogle Scholar
  48. 48.
    Bishop CM (1995) Neural networks and pattern recognition. Oxford University Press, OxfordGoogle Scholar
  49. 49.
    Nguyen D, Widrow B (1990) Improving the learning speed of 2-layer neural network by choosing initial values of the adaptative weights. In: International joint conference on neural networks (IJCNN). IEEE, San Diego, pp 21–26Google Scholar
  50. 50.
    Wang X-Z, Wang R, Xu C (2018) Discovering the relationship between generalization and uncertainty by incorporating complexity of classification. IEEE Trans Cybern 48:703–715CrossRefGoogle Scholar
  51. 51.
    Wang R, Wang X-Z, Kwong S, Xu C (2017) Incorporating diversity and informativeness in multiple-instance active learning. IEEE Trans Fuzzy Syst 25:1460–1475CrossRefGoogle Scholar
  52. 52.
    Ashfaq R, Wang X-Z, Huang J, Abbas H, He Y-L (2017) Fuzziness based semi-supervised learning approach for intrusion detection system. Inf Sci 378:484–497CrossRefGoogle Scholar
  53. 53.
    Wang X-Z, Xing H-J, Li Y, Hua Q, Dong CR, Pedrycz W (2017) A study on relationship between generalization abilities and fuzziness of base classifiers in ensemble learning. IEEE Trans Fuzzy Syst 23:1638–1654CrossRefGoogle Scholar
  54. 54.
    Lecun Y, Bengio Y, Hinton G (2015) Deep learning. Nature 521(7553):436–444CrossRefGoogle Scholar
  55. 55.
    Fernandez Maimo L, Perales Gomez AL, Garcia Clemente FJ, Gil Perez M, Martinez Perez. G (2018) A self-adaptive deep learning-based system for anomaly detection in 5G networks. IEEE Access 6(6):7700–7712CrossRefGoogle Scholar
  56. 56.
    Abeshu A, Chilamkurti N (2018) Deep learning: the frontier for distributed attack detection in fog-to-things computing. IEEE Commun Mag 56(2):169–175CrossRefGoogle Scholar
  57. 57.
    Kebede TM, Djaneye-Boundjou O, Narayanan BN, Ralescu A, Kapp D (2017) Classification of malware programs using autoencoders based deep learning architecture and its application to the microsoft malware classification challenge (big 2015) dataset. Proc IEEE Natl Aerosp Electron Conf NAECON 2017:70–75Google Scholar
  58. 58.
    Xin Y, Kong L, Liu Z, Chen Y, Li Y, Zhu H, Gao M, Hou H, Wang C (2018) Machine learning and deep learning methods for cybersecurity. IEEE Access 6:35365–35381CrossRefGoogle Scholar
  59. 59.
    Islam R, Abawajy J (2013) A multi-tier phishing detection and filtering approach. J Netw Comput Appl 36(1):324–335CrossRefGoogle Scholar
  60. 60.
    Almomani A, Gupta BB, Atawneh S, Meulenberg A, Almomani E (2013) A survey of phishing email filtering techniques. IEEE Commun Surv Tutor 15(4):2070–2090CrossRefGoogle Scholar
  61. 61.
    Drucker H, Wu D, Vapnik VN (1999) Support vector machines for spam categorization. IEEE Trans Neural Netw Publ IEEE Neural Netw Counc 10(5):1048–54CrossRefGoogle Scholar
  62. 62.
    Jagatic TN, Johnson NA, Jakobsson M, Menczer F (2007) Social phishing. Commun ACM 50(10):94–100CrossRefGoogle Scholar
  63. 63.
    Mohammad RM, Thabtah F, McCluskey L (2015) Tutorial and critical analysis of phishing websites methods. Comput Sci Rev 17:1–24MathSciNetCrossRefGoogle Scholar
  64. 64.
    Cranor LF, Lamacchia BA (1998) Spam!. Commun ACM 41(8):74–83CrossRefGoogle Scholar
  65. 65.
    SANS Institute. Top 15 Malicious Spyware Actions (2018)
  66. 66.
    Kim SC, Lee SW, Sung KJ, Kim SK (2012) Splog detection usingstructural similarity between posts and URL biasedness in posts. J Internet Technol 13(5):767–772Google Scholar
  67. 67.
    Zhu L, Sun A, Choi B (2011) Detecting spam blogs from blog search results. Inf Process Manag 47(2):246–262CrossRefGoogle Scholar
  68. 68.
    Luckner M, Gad M, Sobkowiak P (2014) Stable web spam detection using features based on lexical items. Comput Secur 46:79–93CrossRefGoogle Scholar
  69. 69.
    Prieto VM, Álvarez M, Cacheda F (2013) SAAD, a content based web spam analyzer and detector. J Syst Softw 86(11):2906–2918CrossRefGoogle Scholar
  70. 70.
    Scarselli F, Tsoi AC, Hagenbuchner M, Noi LD (2013) Solving graph data issues using a layered architecture approach with applications to web spam detection. Neural Netw Off J Int Neural Netw Soc 48:78–90CrossRefGoogle Scholar
  71. 71.
    Martinez-Romo J, Araujo L (2013) Detecting malicious tweets in trending topics using a statistical analysis of language. Expert Syst Appl 40(8):2992–3000CrossRefGoogle Scholar
  72. 72.
    Stern H (2008) A survey of modern spam tools. In: 5th conference on email and anti-spam, CEAS 2008. Conference on email and anti-spam, CEASGoogle Scholar
  73. 73.
    Guzella TS, Caminhas WM (2009) A review of machine learning approaches to spam filtering. Expert Syst Appl 36(7):10206–10222CrossRefGoogle Scholar
  74. 74.
    Fawcett T (2003) “In vivo” spam filtering: a challenge problem for KDD. SIGKDD Explor 5(2):140–148CrossRefGoogle Scholar
  75. 75.
    Sahami M, Dumais S, Heckerman D, Horvitz E (1998) A Bayesian approach to filtering junk E-mail. Tech. rep. WS-98-05Google Scholar
  76. 76.
    Graham P (2003) A plan for spam. Accessed 26 June 2003
  77. 77.
    Wang ZJ, Liu Y, Wang ZJ (2014) E-mail filtration and classification based on variable weights of the Bayesian algorithm. Appl Mech Mater 513–517:2111–2114Google Scholar
  78. 78.
    Dewdney N, VanEss-Dykema C, MacMillan R (2001) The form is the substance. In: Proceedings of the workshop on human language technology and knowledge management, vol 2001, Morristown, NJ, USA. Association for Computational Linguistics, pp 1–8Google Scholar
  79. 79.
    Almeida J, Almeida T, Yamakami A (2011) Spam filtering: how the dimensionality reduction affects the accuracy of Naive Bayes classifiers. J Internet Serv Appl 1(3):183–200CrossRefGoogle Scholar
  80. 80.
    Song Y, Kołcz A, Giles CL (2009) Better Naive Bayes classification for high-precision spam detection. Softw Pract Exp 39(11):1003–1024CrossRefGoogle Scholar
  81. 81.
    Amayri O, Bouguila N (2010) A study of spam filtering using support vector machines. Artif Intell Rev 34(1):73–108CrossRefGoogle Scholar
  82. 82.
    Hsu W-C, Yu T-Y (2010) E-mail spam filtering based on support vector machines with Taguchi method for parameter selection. J Converg Inf Technol 5(8):78–88Google Scholar
  83. 83.
    Caruana G, Li M, Qi M (2011) A MapReduce based parallel SVM for large scale spam filtering. In: IEEE 2011 eighth international conference on fuzzy systems and knowledge discovery (FSKD), vol 4, pp 2659–2662Google Scholar
  84. 84.
    Dean J, Ghemawat S (2008) MapReduce: simplified data processing on large clusters. Commun ACM 51(1):107–113CrossRefGoogle Scholar
  85. 85.
    Wu C-H (2009) Behavior-based spam detection using a hybrid method of rule-based techniques and neural networks. Expert Syst Appl 36(3):4321–4330CrossRefGoogle Scholar
  86. 86.
    Tseng L-S, Wu C-H (2003) Detection of spam e-mails by analyzing the distributing behaviors of e-mail servers. In: Proceedings of the third international conference on hybrid intelligent systems, pp 1024–1033Google Scholar
  87. 87.
    Gupta A, Singhal C, Aggarwal S (2012) An improved anti spam filter based on content, low level features and noise. Lect Notes Inst Comput Sci Soc Inf Telecommun Engi LNICST 84(PART 1):563–572Google Scholar
  88. 88.
    Li P, Yan H, Cui G, Du Y (2012) Integration of local and global features for image spam filtering. J Comput Inf Syst 8(2):779–789Google Scholar
  89. 89.
    Biggio B, Fumera G, Pillai I, Roli F (2011) A survey and experimental evaluation of image spam filtering techniques. Pattern Recognit Lett 32(10):1436–1446CrossRefGoogle Scholar
  90. 90.
    Hazza ZM, Aziz NA (2015) A new efficient text detection method for image spam filtering. Int Rev Comput Softw 10(1):1–8Google Scholar
  91. 91.
    Liu T-J, Wu C-N, Lee C-L, Chen C-W (2014) A self-adaptable image spam filtering system. J Chin Inst Eng Trans Chin Inst Eng Ser A (Chung-kuo Kung Ch’eng Hsuch K’an) 37(4):517–528Google Scholar
  92. 92.
    Manek AS, Shamini DK, Bhat VH, Shenoy PD, Mohan MC, Venugopal KR, Patnaik LM (2014) Rep-etd: a repetitive preprocessing technique for embedded text detection from images in spam emails. In: pp 568–573Google Scholar
  93. 93.
    Wakade S, Liszka KJ, Chan C-C (2013) Application of learning algorithms to image spam evolution. Smart Innov Syst Technol 13:471–495CrossRefGoogle Scholar
  94. 94.
    Attar A, Rad RM, Atani RE (2013) A survey of image spamming and filtering techniques. Artif Intell Rev 40(1):71–105CrossRefGoogle Scholar
  95. 95.
    Romero C, Garcia-Valdez M, Alanis A (2010) A comparative study of blog comments spam filtering with machine learning techniques. Stud Comput Intell 312:57–72Google Scholar
  96. 96.
    Yang W, Dong G, Wang W, Hu Y, Shen G, Yu M (2015) A novel approach for bots detection in sina microblog. J Comput Theor Nanosci 12(7):1420–1425CrossRefGoogle Scholar
  97. 97.
    Abu-Nimeh S, Chen T (2010) Proliferation and detection of blog spam. IEEE Secur Priv Mag 8(5):42–47CrossRefGoogle Scholar
  98. 98.
    Kolari P, Java A, Finin T, Oates T, Joshi A (2006) Detecting spam blogs: a machine learning approach. Proc Natl Conf Artif Intell 2:1351–1356Google Scholar
  99. 99.
    Yoshinaka T, Ishii S, Fukuhara T, Masuda H, Nakagawa H (2010) A user-oriented splog filtering based on a machine learning. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 6045 LNCS((M4D)):88–99Google Scholar
  100. 100.
    Sculley D, Wachman GM (2007) Relaxed online SVMS for spam filtering. In: pp 415–422Google Scholar
  101. 101.
    McCord M, Chuah M (2011) Spam detection on twitter using traditional classifiers. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 6906 LNCS:175–186Google Scholar
  102. 102.
    Breiman L (2001) Random forests. Mach Learn 45(1):5–32zbMATHCrossRefGoogle Scholar
  103. 103.
    Soman SJ, Murugappan S (2014) Detecting malicious tweets in trending topics using clustering and classificationGoogle Scholar
  104. 104.
    Chu Z, Gianvecchio S, Wang H, Jajodia S (2010) Who is tweeting on twitter: human, bot, or cyborg? In: pp 21–30Google Scholar
  105. 105.
    Wang AH (2010) Detecting spam bots in online social networking sites: a machine learning approach. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 6166 LNCS:335–342Google Scholar
  106. 106.
    Wang AH (2010) Don’t follow me—spam detection in twitter. In: pp 142–151Google Scholar
  107. 107.
    Santos I, Miñambres-Marcos I, Laorden C, Galán-García P, Santamaría-Ibirika A, García Bringas P (2014) Twitter content-based spam filtering. Adv Intell Syst Comput 239:449–458Google Scholar
  108. 108.
    Zangerle E, Specht G (2014) “sorry, i was hacked” a classification of compromised twitter accounts. In: pp 587–593Google Scholar
  109. 109.
    Benevenuto F, Rodrigues T, Almeida V, Almeida J, Zhang C, Ross K (2008) Identifying video spammers in online social networks. In: pp 45–52Google Scholar
  110. 110.
    Benevenuto F, Rodrigues T, Veloso A, Almeida J, Goncalves M, Almeida V (2012) Practical detection of spammers and content promoters in online video sharing systems. IEEE Trans Syst Man Cybern Part B Cybern 42(3):688–701CrossRefGoogle Scholar
  111. 111.
    Indira K, Christal Joy E (2014) Prevention of spammers and promoters in video social networks using SVM-knn. Int J Eng Technol 6(5):2024–2030Google Scholar
  112. 112.
    Stolfo SJ, Hershkop S, Bui LH, Ferster R, Wang K (2005) Anomaly detection in computer security and an application to file system accesses. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 3488 LNAI:14–28Google Scholar
  113. 113.
    Chen Z, Ji C (2005) Spatial-temporal modeling of malware propagation in networks. IEEE Trans Neural Netw 16(5):1291–1303CrossRefGoogle Scholar
  114. 114.
    Lin J (2008) On malicious software classification. In: pp 368–371Google Scholar
  115. 115.
    Li P, Liu L, Gao D, Reiter MK (2010) On challenges in evaluating malware clustering. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 6307 LNCS:238–255Google Scholar
  116. 116.
    Nakazato J, Song J, Eto M, Inoue D, Nakao K (2011) A novel malware clustering method using frequency of function call traces in parallel threads. IEICE Trans Inf Syst E94–D(11):2150–2158CrossRefGoogle Scholar
  117. 117.
    Shafiq MZ, Khayam SA, Farooq M (2008) Improving accuracy of immune-inspired malware detectors by using intelligent features. In: pp 119–126Google Scholar
  118. 118.
    Bose A, Hu X, Shin KG, Park T (2008) Behavioral detection of malware on mobile handsets. In: pp 225–238Google Scholar
  119. 119.
    Anderson B, Quist D, Neil J, Storlie C, Lane T (2011) Graph-based malware detection using dynamic analysis. J Comput Virol 7(4):247–258CrossRefGoogle Scholar
  120. 120.
    Chandramohan M, Tan HBK, Briand LC, Shar LK, Padmanabhuni BM (2013) A scalable approach for malware detection through bounded feature space behavior modeling. In: pp 312–322Google Scholar
  121. 121.
    Dhaya R, Poongodi M (2015) Detecting software vulnerabilities in android using static analysis. In: pp 915–918Google Scholar
  122. 122.
    Durand J, Atkison T (2012) Applying random projection to the classification of malicious applications using data mining algorithms. In: pp 286–291Google Scholar
  123. 123.
    Ismail I, Marsono MN, Nor SM (2014) Malware detection using augmented naive bayes with domain knowledge and under presence of class noise. Int J Inf Comput Secur 6(2):179–197Google Scholar
  124. 124.
    Lu W, Rammidi G, Ghorbani AA (2011) Clustering botnet communication traffic based on n-gram feature selection. Comput Commun 34(3):502–514CrossRefGoogle Scholar
  125. 125.
    Markel Z, Bilzor M (2015) Building a machine learning classifier for malware detection. In: Second workshop on anti-malware testing research (WATeR). IEEE, Canterbury, UK.
  126. 126.
    Merkel R, Hoppe T, Kraetzer C, Dittmann J (2010) Statistical detection of malicious pe-executables for fast offline analysis. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 6109 LNCS:93–105Google Scholar
  127. 127.
    Moskovitch R, Elovici Y (2008) Unknown malicious code detection—practical issues. In: pp 145–152Google Scholar
  128. 128.
    Ponomarev S, Durand J, Wallace N, Atkison T (2013) Evaluation of random projection for malware classification. In: pp 68–73Google Scholar
  129. 129.
    Reddy DKS, Pujari AK (2006) N-gram analysis for computer virus detection. J Comput Virol 2(3):231–239CrossRefGoogle Scholar
  130. 130.
    Santos I, Penya YK, Devesa J, Bringas PG (2009) N-grams-based file signatures for malware detection. In: Volume AIDSS, pp 317–320Google Scholar
  131. 131.
    Shabtai A, Moskovitch R, Elovici Y, Glezer C (2009) Detection of malicious code by applying machine learning classifiers on static features: a state-of-the-art survey. Inf Secur Tech Rep 14(1):16–29 MalwareCrossRefGoogle Scholar
  132. 132.
    Shahzad F, Farooq M (2012) Elf-miner: using structural knowledge and data mining methods to detect new (linux) malicious executables. Knowl Inf Syst 30(3):589–612CrossRefGoogle Scholar
  133. 133.
    Shijo PV, Salim A (2015) Integrated static and dynamic analysis for malware detection. Procedia Comput Sci 46:804–811CrossRefGoogle Scholar
  134. 134.
    Siddiqui M, Wang MC, Lee J (2008) A survey of data mining techniques for malware detection using file features. In: pp 509–510Google Scholar
  135. 135.
    Uppal D, Sinha R, Mehra V, Jain V (2014) Malware detection and classification based on extraction of API sequences. In: pp 2337–2342Google Scholar
  136. 136.
    Wressnegger C, Schwenk G, Arp D, Rieck K (2013) A close look on n-grams in intrusion detection: anomaly detection vs. classification. In: pp 67–76Google Scholar
  137. 137.
    Yu W, Zhang H, Ge L, Hardy R (2013) On behavior-based detection of malware on android platform. In: pp 814–819Google Scholar
  138. 138.
    Yuxin D, Wei D, Yibin Z, Chenglong X (2014) Malicious code detection using opcode running tree representation. In: pp 616–621Google Scholar
  139. 139.
    Yuxin D, Xuebing Y, Di Z, Li D, Zhanchao A (2011) Feature representation and selection in malicious code detection methods based on static system calls. Comput Secur 30(6–7):514–524CrossRefGoogle Scholar
  140. 140.
    Zolotukhin M, Hämäläinen T (2013) Support vector machine integrated with game-theoretic approach and genetic algorithm for the detection and classification of malware. In: pp 211–216Google Scholar
  141. 141.
    Cova M, Kruegel C, Vigna G (2010) Detection and analysis of drive-by-download attacks and malicious javascript code. In: pp 281–290Google Scholar
  142. 142.
    Zhu K, Yin B (2012) Malware behavior classification approach based on naive bayes. J Converg Inf Technol 7(5):203–210Google Scholar
  143. 143.
    Zhu K, Yin B, Mao Y, Hu Y (2014) Malware classification approach based on valid window and naive bayes. Comput Res Dev (Jisuanji Yanjiu yu Fazhan) 51(2):373–381Google Scholar
  144. 144.
    Bat-Erdene M, Kim T, Li H, Lee H (2013) Dynamic classification of packing algorithms for inspecting executables using entropy analysis. In: pp 19–26Google Scholar
  145. 145.
    Ban T, Isawa R, Guo S, Inoue D, Nakao K (2013) Application of string kernel based support vector machine for malware packer identification. In: The 2013 international joint conference on neural networks (IJCNN). IEEE, Dallas, TX, USA.
  146. 146.
    Divya S, Padmavathi G (2014) A novel method for detection of internet worm malcodes using principal component analysis and multiclass support vector machine. Int J Secur Appl 8(5):391–402Google Scholar
  147. 147.
    Komiya R, Paik I, Hisada M (2011) Classification of malicious web code by machine learning. In: pp 406–411Google Scholar
  148. 148.
    Nissim N, Moskovitch R, Rokach L, Elovici Y (2012) Detecting unknown computer worm activity via support vector machines and active learning. Pattern Anal Appl 15(4):459–475MathSciNetCrossRefGoogle Scholar
  149. 149.
    Nissim N, Moskovitch R, Rokach L, Elovici Y (2014) Novel active learning methods for enhanced pc malware detection in windows os. Expert Syst Appl 41(13):5843–5857CrossRefGoogle Scholar
  150. 150.
    Okane P, Sezer S, McLaughlin K, Im EG (2014) Malware detection: program run length against detection rate. IET Softw 8(1):42–51CrossRefGoogle Scholar
  151. 151.
    Sanjaa B, Chuluun E (2013) Malware detection using linear SVM. In: vol 2, pp 136–138Google Scholar
  152. 152.
    Wang P, Wang Y-S (2015) Malware behavioural detection and vaccine development by using a support vector model classifier. J Comput Syst Sci 81(6):1012–1026CrossRefGoogle Scholar
  153. 153.
    Zhao M, Ge F, Zhang T, Yuan Z (2011) Antimaldroid: an efficient SVM-based malware detection framework for android. Commun Comput Inf Sci 243 CCIS(PART 1):158–166Google Scholar
  154. 154.
    Biggio B, Corona I, Nelson B, Rubinstein BIP, Maiorca D, Fumera G, Giacinto G, Roli F (2014) Security evaluation of support vector machines in adversarial environmentsGoogle Scholar
  155. 155.
    Firdausi I, Lim C, Erwin A, Nugroho AS (2010) Analysis of machine learning techniques used in behavior-based malware detection. In: pp 201–203Google Scholar
  156. 156.
    Canzanese R, Kam M, Mancoridis S (2013) Toward an automatic, online behavioral malware classification system. In: pp 111–120Google Scholar
  157. 157.
    Dube T, Raines R, Peterson G, Bauer K, Grimaila M, Rogers S (2012) Malware target recognition via static heuristics. Comput Secur 31(1):137–147CrossRefGoogle Scholar
  158. 158.
    Haddadi F, Runkel D, Nur Zincir-Heywood A, Heywood MI (2014) On botnet behaviour analysis using gp and c4.5. In: pp 1253–1260Google Scholar
  159. 159.
    Ye W, Cho K (2014) Hybrid p2p traffic classification with heuristic rules and machine learning. Soft Comput 18(9):1815–1827CrossRefGoogle Scholar
  160. 160.
    Borgolte K, Kruegel C, Vigna G (2013) Delta: automatic identification of unknown web-based infection campaigns. In: pp 109–120Google Scholar
  161. 161.
    Mohaisen A, Alrawi O (2015) AMAL: high-fidelity, behavior-based automated malware analysis and classification. In: Rhee KH, Yi J (eds) Information security applications, WISA 2014. Lecture notes in computer science, vol 8909. Springer, pp 107–121Google Scholar
  162. 162.
    Rieck K, Trinius P, Willems C, Holz T (2011) Automatic analysis of malware behavior using machine learning. J Comput Secur 19(4):639–668CrossRefGoogle Scholar
  163. 163.
    Menahem E, Shabtai A, Rokach L, Elovici Y (2009) Improving malware detection by applying multi-inducer ensemble. Comput Stat Data Anal 53(4):1483–1494MathSciNetzbMATHCrossRefGoogle Scholar
  164. 164.
    Shabtai A, Fledel Y, Elovici Y (2010) Automated static code analysis for classifying android applications using machine learning. In: pp 329–333Google Scholar
  165. 165.
    Huang C-Y, Tsai Y-T, Hsu C-H (2013) Performance evaluation on permission-based detection for android malware. Smart Innov Syst Technol 21:111–120CrossRefGoogle Scholar
  166. 166.
    Glodek W, Harang R (2013) Rapid permissions-based detection and analysis of mobile malware using random decision forests. In: pp 980–985Google Scholar
  167. 167.
    Alam MS, Vuong ST (2013) Random forest classification for detecting android malware. In: pp 663–669Google Scholar
  168. 168.
    Ng DV, Hwang J-IG (2015) Android malware detection using the dendritic cell algorithm. In: IEEE international conference on machine learning and cybernetics, Lanzhou, China, pp 257–262Google Scholar
  169. 169.
    Pehlivan U, Baltaci N, Acarturk C, Baykal N (2014) The analysis of feature selection methods and classification algorithms in permission based android malware detection. In: IEEE symposium on computational intelligence in cyber security (CICS), Orlando, FL, USA.
  170. 170.
    Barbareschi M, De Benedictis A, Mazzeo A, Vespoli A (2014) Mobile traffic analysis exploiting a cloud infrastructure and hardware accelerators. In: pp 414–41Google Scholar
  171. 171.
    Yu W, Zhang H, Xu G (2013) A study of malware detection on smart mobile devices. In: vol 8757Google Scholar
  172. 172.
    Yerima SY, Sezer S, Muttik I (2014) Android malware detection using parallel machine learning classifiers. In: pp 37–42Google Scholar
  173. 173.
    Feldman S, Stadther D, Wang B (2015) Manilyzer: automated android malware detection through manifest analysis. In: pp 767–77Google Scholar
  174. 174.
    Gates CS, Li N, Peng H, Sarma B, Qi Y, Potharaju R, Nita-Rotaru C, Molloy I (2014) Generating summary risk scores for mobile applications. IEEE Trans Dependable Secure Comput 11(3):238–251CrossRefGoogle Scholar
  175. 175.
    Yu L, Pan Z, Liu J, Shen Y (2013) Android malware detection technology based on improved bayesian classification. In: pp 1338–1341Google Scholar
  176. 176.
    Shabtai A, Kanonov U, Elovici Y, Glezer C, Weiss Y (2012) “Andromaly”: a behavioral malware detection framework for android devices. J Intell Inf Syst 38(1):161–190CrossRefGoogle Scholar
  177. 177.
    Sanz B, Santos I, Laorden C, Ugarte-Pedrero X, Bringas PG (2012) On the automatic categorisation of android applications. In: pp 149–153Google Scholar
  178. 178.
    Feizollah A, Anuar NB, Salleh R, Amalina F, Ma’arof RR, Shamshirband S (2013) A study of machine learning classifiers for anomaly-based mobile botnet detection. Malays J Comput Sci 26(4):251–265Google Scholar
  179. 179.
    Ham H-S, Kim H-H, Kim M-S, Choi M-J (2014) Linear SVM-based android malware detection. Lect Notes Electr Eng 301:575–585CrossRefGoogle Scholar
  180. 180.
    Narayanan A, Chen L, Chan CK (2014) AdDetect: automated detection of android ad libraries using semantic analysis. In: IEEE ninth international conference on intelligent sensors, sensor networks and information processing (ISSNIP). IEEE, Singapore.
  181. 181.
    Sahs J, Khan L (2012) A machine learning approach to android malware detection. In: pp 141–147Google Scholar
  182. 182.
    Spreitzenbarth M, Schreck T, Echtler F, Arp D, Hoffmann J (2015) Mobile-sandbox: combining static and dynamic analysis with machine-learning techniques. Int J Inf Secur 14(2):141–153CrossRefGoogle Scholar
  183. 183.
    Sheen S, Anitha R, Natarajan V (2015) Android based malware detection using a multifeature collaborative decision fusion approach. Neurocomputing 151(P2):905–912CrossRefGoogle Scholar
  184. 184.
    Allix K, Bissyandé TF, Jérome Q, Klein J, State R, Le Traon Y (2014) Empirical assessment of machine learning-based malware detectors for Android. Empir Softw Eng 21:183–211CrossRefGoogle Scholar
  185. 185.
    Allix K, Bissyandé TF, Klein J, Traon YL (2015) Are your training datasets yet relevant? an investigation into the importance of timeline in machine learning-based malware detection. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 8978:51–67Google Scholar
  186. 186.
    Fette I, Sadeh N, Tomasic A (2007) Learning to detect phishing emails. In: Proceedings of the 16th international conference on World Wide Web (WWW ’07), New York (US), ACM, pp 649–656Google Scholar
  187. 187.
    Zhang L, Yao T (2003) Filtering junk mail with a maximum entropy model. In: pp 446–453Google Scholar
  188. 188.
    Gu X, Wang H, Ni T (2013) An efficient approach to detecting phishing web. J Comput Inf Syst 9(14):5553–5560Google Scholar
  189. 189.
    He M, Horng S, Fan P, Khan M Khurram, Run R, Lai J, Chen R, Sutanto A (2011) An efficient phishing webpage detector. Expert Syst Appl 38(10):12018–12027CrossRefGoogle Scholar
  190. 190.
    Cao J, Dong D, Mao B, Wang T (2013) Phishing detection method based on url features. J Southeast Univ (English Edition) 29(2):134–138Google Scholar
  191. 191.
    Chandrasekaran M, Narayanan K, Upadhyaya S (2006) Phishing E-mail detection based on structural properties. In: Proceedings of 9th annual NYS cyber security conference, Albany, NY, USA, pp 2–8Google Scholar
  192. 192.
    Ma L, Ofoghi B, Watters P, Brown S (2009) Detecting phishing emails using hybrid features. In: pp 493–497Google Scholar
  193. 193.
    Santhana Lakshmi V, Vijaya MS (2012) Efficient prediction of phishing websites using supervised learning algorithms. Procedia Eng 30:798–805CrossRefGoogle Scholar
  194. 194.
    Akinyelu AA, Adewumi AO (2014) Classification of phishing email using random forest machine learning technique. J Appl Math 2014:1–6CrossRefGoogle Scholar
  195. 195.
    Webber CG, De Fátima M, Do Prado Lima W, Hepp FS (2012) Testing phishing detection criteria and methods. Adv Intell Soft Comput 133AISC:853–858CrossRefGoogle Scholar
  196. 196.
    Del Castillo MD, Iglesias Á, Serrano JI (2007) An integrated approach to filtering phishing e-mails. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 4739 LNCS:321–328Google Scholar
  197. 197.
    Xiang G, Hong J, Rose CP, Cranor L (2011) Cantina+: a feature-rich machine learning framework for detecting phishing web sites. ACM Trans Inf Syst Secur 14(2):1–28CrossRefGoogle Scholar
  198. 198.
    Patil R, Dasharath DB, Dhonde KS, Chinchwade RG, Mehetre SB (2014) A hybrid model to detect phishing-sites using clustering and bayesian approach. Int J Comput Sci Netw Secur 15:92–95Google Scholar
  199. 199.
    Basnet RB, Sung AH, Liu Q (2012) Feature selection for improved phishing detection. Lect Notes Comput Sci (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 7345 LNAI:252–261Google Scholar
  200. 200.
    Qabajeh I, Thabtah F (2014) An experimental study for assessing email classification attributes using feature selection methods. In: pp 125–132Google Scholar

Copyright information

© Springer-Verlag GmbH Germany, part of Springer Nature 2019

Authors and Affiliations

  1. 1.Universidad Internacional de la RiojaLogroñoSpain
  2. 2.University of VigoVigoSpain
  3. 3.University of OviedoOviedoSpain

Personalised recommendations