Machine Learning for Cyber Defense: A Comparative Analysis of Supervised and Unsupervised Learning Approaches

Abstract

Machine Learning presents itself as a game changer within the domain of cyber defense, but a systematic review of literature denotes that research effort is largely skewed towards a supervised learning approach. This paper will extend and add value to the literature by filling this gap and investigating the supervised and unsupervised learning approaches within this disciplinary context. By using a clustering algorithm to group research articles, and association rule mining to further understand those groupings, a comparative analysis of both approaches is provided. The results indicate that, despite supervised learning’s dominance, the use of unsupervised algorithms has seen a rapid ascent over recent years. Moreover, it also shows that unsupervised learning is more focused on data or information gathering and identification, stemming from event logs, alerts or white and dark data. In this study, several implications and recommendations have been evaluated in order to more effectively combat cyber security threats. Machine Learning (ML) and its subsets have gained rapid momentum in cyber security research and play crucial roles in maturing data. To understand emerging threat vectors and security domains, ML algorithms are employed to codify the threat behavior exploitation. Despite the various applications, research initiatives into cyber security and the different machine learning algorithms used to revolutionize the understanding of data and the approach of intelligent decisions associated with the data are discussed. This mode of research exposes a noteworthy observation of a slight comparative evolution of the body of knowledge when it comes to supervised or unsupervised methods in this critical domain. Therefore, a comprehensive evaluation is presented of previous studies and methodologies. To consolidate these results, a meta-analytical process is scaled. This analysis breaks down the existing research by defining the applied learning algorithms. In addition, the most extensively used algorithm is elucidated to indicate trends and analysis that are revealing about the innovative application and KDD processes in the context of cyber security.