Authors:
Alaa Mohasseb
1
;
Benjamin Aziz
1
;
Jeyong Jung
2
and
Julak Lee
3
Affiliations:
1
School of Computing, University of Portsmouth and U.K.
;
2
Institute of Criminal Justice Studies, University of Portsmouth and U.K.
;
3
Department of Security Management, Kyonggi University, Suwon and South Korea
Keyword(s):
Text Mining, Cybersecurity, Malware, Malicious Code, Machine Learning.
Related
Ontology
Subjects/Areas/Topics:
Internet Technology
;
Intrusion Detection and Response
;
Web Information Systems and Technologies
Abstract:
The increasing amount and complexity of cyber security attacks in recent years have made text analysis and data-mining based techniques an important factor in detecting security threats. However, despite the popularity of text and other data mining techniques, the cyber security community has remained somehow reluctant in adopting an open approach to security-related data. In this paper, we analyze a dataset that has been collected from five Small and Medium companies in South Korea, this dataset represents cyber security incidents and response actions. We investigate how the data representing different incidents collected from multiple companies can help improve the classification accuracy and help the classifiers in distinguishing between different types of incidents. A model has been developed using text mining methods, such as n-gram, bag-of-words and machine learning algorithms for the classification of incidents and their response actions. Experimental results have demonstrated
good performance of the classifiers for the prediction of different types of response and malware.
(More)