 |
For tactic learning, we choose linear model classifiers and tree-based model classifiers and evaluate the labeling result from different Machine learning algorithms.
For tactic labeling with linear model classifiers, we choose Support Vector Machine (SVM) and K-Nearest Neighbours (KNN) as the evaluated targets. SVM classifies data through multi-dimensional hyperplane segmentation. The appropriate weights will be obtained in the training phase. KNN generally does not have an actual data training process. Instead, it calculates the distance between the test data and each training data in the prediction stage, finds the 8 adjacent data, and uses the category with the highest frequency as the classification result.
For tactic labeling with tree-based model classifiers, we use Decision Tree and Random Forest as the evaluated targets. A decision tree is a flowchart-like structure. Each internal node represents a "test" on an attribute, each branch represents the test result, and each leaf node represents a class label. The paths from the root to the leaf represent classification rules. Random forest is an ensemble learning method for classification work that operates by constructing many decision trees at training time. The output of the random forest is the class selected by most trees.
For tactic testing, the feature of testing dataset are extracts through the TF-IDF Vectorizer function, and then the tactic to which the Suricata rule belongs is predicted with the pre-trained model. |
IEEE/ICACT20220038 Slide.19
[Big Slide]