Measuring concept drift in malware and network intrusion detection models

This thesis delves into the phenomenon of concept drift, a critical issue in the field of machine learning where the statistical properties of the target variable, which the model is trying to predict, change over time. This work is particularly focused on understanding the reason and impact of concept drift in cybersecurity contexts through measurement and modeling approaches, using both Portable Executable (PE) files in Windows and Android malware datasets, as well as network data from a real-world Security Operations Center (SOC) facility. The research begins with a comprehensive introduction to the concept drift, laying out its definitions and taxonomies, specifically highlighting feature drift and data drift. It then proceeds to explore these types of drifts using a PE/Android dataset, analyzing how feature and data drifts manifest in these domains. Subsequently, the thesis introduces a novel model designed to detect data drift in network traffic. The model employs a unique approach to generate cross-host features and utilizes a Support Vector Machine (SVM) for the detection of data drift. Meanwhile, we also perform measurements to understand the network attacks. Through rigorous analysis and modeling, the research presents a concrete step to the understanding of the reason and impact of concept drift in cybersecurity, presenting a novel approach to network intrusion detection that can be beneficial for future research and practical applications in the field. The findings not only enhance the academic understanding of concept drift but also offer practical solutions to detect and adapt to it in dynamic environments, thereby improving the robustness and reliability of machine learning models in security-sensitive applications.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Computer Science

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2024

Author dc:creator

• Zhang, Zhenning

Contributors dc:contributor

• Wang, Gang

• Concept Drift
• Malware Detection
• Network Security

Statement dc:rights

• Copyright 2024 Zhenning Zhang

Language dc:language

en, eng

Handle dc:identifier

https://hdl.handle.net/2142/124267

OAI record oai:identifier

https://www.ideals.illinois.edu/oai-pmh?verb=GetRecord&metadataPrefix=etdms&identifier=oai%3Awww.ideals.illinois.edu%3A2142%2F124267