Hands-On Machine Learning for Cybersecurity

Safeguard your system by making your machines intelligent using the Python ecosystem

Soma Halder, Sinan Ozdemir

• Publisher: Packt Publishing
• Year: 2018
• ISBN:
  9781788990967
• Edition: 1
• Topic: Computer Science
• Subtopic: Artificial Intelligence (AI) & Semantics
• Index: Computer Science

Get into the world of smart data security using machine learning algorithms and Python libraries

Key Features

• Learn machine learning algorithms and cybersecurity fundamentals
• Automate your daily workflow by applying use cases to many facets of security
• Implement smart machine learning solutions to detect various cybersecurity problems

Book Description

Cyber threats today are one of the costliest losses that an organization can face. In this book, we use the most efficient tool to solve the big problems that exist in the cybersecurity domain.

The book begins by giving you the basics of ML in cybersecurity using Python and its libraries. You will explore various ML domains (such as time series analysis and ensemble modeling) to get your foundations right. You will implement various examples such as building system to identify malicious URLs, and building a program to detect fraudulent emails and spam. Later, you will learn how to make effective use of K-means algorithm to develop a solution to detect and alert you to any malicious activity in the network. Also learn how to implement biometrics and fingerprint to validate whether the user is a legitimate user or not.

Finally, you will see how we change the game with TensorFlow and learn how deep learning is effective for creating models and training systems

What you will learn

• Use machine learning algorithms with complex datasets to implement cybersecurity concepts
• Implement machine learning algorithms such as clustering, k-means, and Naive Bayes to solve real-world problems
• Learn to speed up a system using Python libraries with NumPy, Scikit-learn, and CUDA
• Understand how to combat malware, detect spam, and fight financial fraud to mitigate cyber crimes
• Use TensorFlow in the cybersecurity domain and implement real-world examples
• Learn how machine learning and Python can be used in complex cyber issues

Who this book is for

This book is for the data scientists, machine learning developers, security researchers, and anyone keen to apply machine learning to up-skill computer security. Having some working knowledge of Python and being familiar with the basics of machine learning and cybersecurity fundamentals will help to get the most out of the book

Catching Impersonators and Hackers Red Handed

Impersonation attacks are the form of cyber attack that has evolved the most in recent years. Impersonation in its most basic form is the act of pretexting as another person. Pretexting is the basic form of social engineering, where a person mimics another person to obtain data or resources that have been assigned to the privileged person only.

To understand impersonation attacks better, and to detect the different attacks and see how machine learning can solve them, we will go through the following topics:

• Understanding impersonation
• Different types of impersonation fraud
• Understanding Levenshtein distance
• Use case on finding malicious domain similarity
• Use case to detect authorship attribution

Understanding impersonation

In the USA, the top two people to impersonate are the following:

• Someone impersonating a USPS agent: Here, someone dressed in a USPS costume to get access to a secure location on the pretext of delivering packages, and will be able to get access to unauthorized areas.

• Someone impersonating a tech support guy: If it's tech support, we are comfortable sharing our credentials, such as login passwords. Tech support impersonators not only steal personally identifiable information, but also have physical access to the servers. A tech support guy can potentially steal a lot with a single pen drive. Tech support guys can not only attack individuals, but also have the capacity to crash entire networks. Just by downloading unauthorized software on the pretext of downloading antiviruses and patches, they can create gateways to access the computer as a background process.

Other popular people to impersonate include the following:

• Law enforcement personnel
• A delivery man

Different types of impersonation fraud

According to a recent report, at least 75 percent of companies are the target of impersonation attempts each year. There are several variations of impersonation; the most popular ones are the following:

• Executive impersonation: These are cases where the impersonator either takes over an executive account, such as a CEO or CFO of the company. The impersonator may also try to spook emails from the executive by putting minute variations in the email IDs, such as [email protected] being changed to [email protected]. The content of these emails will deal with sensitive issues needing immediate action, such as a wire transfer that needs to be mailed urgently. Employees usually ignore the falsification of the email ID and carry out the activity.
• Vendor impersonation: This is another type of fraud, where the impersonator spooks email IDs of legitimate vendors and sends out emails about changes in payment information. The emails will have a new banking address where future emails need to be sent.
• Customer impersonation: Some impersonators spoof the customer's account just to collect confidential or valuable information that can be used in future fraud.
• Identity theft: This is a popular form of impersonation, done a...