Cyber Attack Prediction Using Recurrent Neural Networks — Complete Documentation & Simulation

Overview & System Context

Cyber Attack Prediction Using Recurrent Neural Networks: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~733 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background RNN implementation in Keras to predict malware from machine activity data - code for experiments in Early Stage Malware Prediction Using Recurrent Neural Networks (^^Percentage certainty of model is for demo-purposes and should not be taken as an indicator of model reliability!) The basic Experiment class in experiments > Experiments takes a dictionary of hyperparameters and data as objects (either as a tuple for k-fold cross validation or as four separate test/train inputs/labels items). Results are stored in a folder as a comma separated values file.

parameters: A dictionary of hyperparamters such as in experiments > Configs . The keys relate to the RNN implementation and the values can either be a list or a dictionary of possible values with associated weighted probabilities of choosing them. The latter is intended to aid biased random searches e.g. params = {.... ["dropout"] = {0.2: 0.5, 0.1: 0.25, 0.3: 0.25}.... } will bias the random search to choose a value of 0.2 half of the time, and 0.1 or 0.3 respectively quarter of the time.

Figure 1: Recurrent Neural Networks (RNNs) 2. System Architecture & Core Working Principles Grid search will explore every possible combination of parameters supplied to the Experiment. Grid search will keep running until all options have been exhausted.

Random search will randomly select a configuration from the possible combinations of parameters, the choice of parameters can be biased by using dictionaries with values representing relative weights between the keys. See Configurations / RNN hyperparameters for more. Random search will run until the num_experiments parameter in Experiment.run() is reached, default=100.

x_train: sequential (3D) tensor of train input data supplied for a train-test experiment y_train: sequential (2D) tensor of train label data supplied for a train-test experiment, corresponding to the indices of the x_train data Figure 2: IIIIIIIIIIIIIIII Recurrent Neural Network (RNN) – II.IIIIIIIIIIII IIIII 3. Software Implementation, Frameworks & Protocols x_test: sequential (3D) tensor of test input data supplied for a train-test experiment y_test: sequential (2D) tensor of test label data supplied for a train-test experiment, corresponding to the indices of the x_test data folds : integer to determine k in k-fold validation, defaults to 10. Must be an integer (or left default) for k-fold validation experiment along with data tuple thresholding : Boolean to determine if k-fold test is cut short when accuracy falls below threshold , defaults to False. When thresholding=True, the threshold automatically increases if the average accuracy of k-folds is greater than the threshold. The new threshold is minimum of the set of k-fold accuracies.

Figure 3: recurrent neural networks 4. Practical Deployment, Analysis & Case Studies threshold : 0 <= float < 1 which determines accuracy level cut off during a k-fold experiment. If a fold acheives lower than threshold , the remaining folds are not run, and the next configuration will begin. Automatically increases if a k-fold experiment achieved higher average accuracy (across k-folds) than threshold to the minimum of the set of k-fold accuracies.

Increase the temporal distance between input features. Add "steps" to parameters dictionary to increase the time interval between data, should be integer <= sequence_length Average the results of multiple RNN models.Experiment will only search sequence_length space, and will take the first value provided for all other hyperparameters if more than one is supplied Average the results of classifying all sub-sequences and the entire data sequence. Experiment will only search sequence_length space, and will take the first value provided for all other hyperparameters if more than one is supplied 5. Performance Evaluation & Extended Technical Observations Leave all possible combinations of input features out of training to see impact of their omission. Trains a model then sequentially omits all possible combinations of 1,2,3...n, where n=total number of features, giving 2047 combinations for the 11 features used in the paper.

Takes a dictionary of parameters, the training data and testing data as input. Data used to determine shape of RNN layers. Possible options for configurations outlined in Configurations / RNN hyperparameters . The configuration dictionaries used in the paper are stored in experiments > Configs . The possible parameters which can be edited and passed into an experiment are as detailed in the table below N.B. these are wider than the limitations of the random search configuration . see the commented code for details of each hyperparameter.

Hyperparameters should be supplied as a dictionary with parameter name as the key and value(s) stored in a list or as the keys of dictionaries. If using dictionaries, also supply relative weights representing the frequency with which the values should be chosen in a random search (the frequencies will be ignored in a grid search) - the lists and dictionaries can be mixed together e.g: Harvested Online Documentation & Reference Sources • https://github.com/mprhode/malware-prediction-rnn