Authors:
Kostas Loumponias
;
Sotiris Raptis
;
Eleni Darra
;
Theodora Tsikrika
;
Stefanos Vrochidis
and
Ioannis Kompatsiaris
Affiliation:
Information Technologies Institute, Centre for Research and Technology Hellas-CERTH, GR-54124, Thessaloniki, Greece
Keyword(s):
Cyber-Attack, Network Traffic, Forecasting, Destination Port.
Abstract:
To anticipate and counter cyber-attacks that may threaten the stability of the economy, society, and governments around the world, significant efforts have made particularly towards the detection of cyber-attacks, while fewer studies have focused on their forecasting. This paper proposes a framework that provides forecasts of upcoming (within the next minute) cyber-attacks, as well as their type, to a specific destination port. To this end, several machine learning-based methods are applied on measurements (observations) obtained from the network traffic flow. The proposed method is supported by two major pillars: first, the selection of appropriate features generated by the network traffic and, second, in addition to the selected features, the detection of the type of cyber-attacks that occurred in the past. The proposed framework is evaluated on the CIC-IDS2017 synthetic dataset and provides a robust performance in forecasting the type of upcoming cyber-attack in terms of Accuracy,
Precision, Recall, F1-score and confusion matrix.
(More)