Ethiopian Defence University, College of

Engineering

CT-6713: Machine Learning in

Cybersecurity

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 1

 Cybersecurity
• Cybersecurity refers to the practice of protecting
• Computer systems, networks, devices,
• Data from unauthorized access, theft, damage,
disruption, or misuse as well
• Ensuring their confidentiality, integrity, and availability
• It encompasses a broad range of technologies, processes,
and practices designed to safeguard digital assets and
mitigate the risks associated with cyber threats

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 2 2

 Key aspects of cybersecurity
• Confidentiality: Ensuring that sensitive information is
accessible only to authorized individuals or entities and
protected from unauthorized access or disclosure.
• Integrity: Maintaining the accuracy, reliability, and
consistency of data and systems by preventing
unauthorized modification, deletion, or alteration.
• Availability: Ensuring that information and resources are
accessible and usable when needed by authorized users,
while defending against denial-of-service (DoS) attacks and
other disruptions.
• Authentication: Verifying the identity of users and devices
to ensure that only authorized individuals or entities can
access sensitive information or perform specific actions.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 3 3

 Cybersecurity
• Authorization: Granting appropriate permissions and
privileges to users and devices based on their roles,
responsibilities, and access requirements.
• Encryption: Using cryptographic techniques to secure data
in transit and at rest, protecting it from interception,
eavesdropping, and unauthorized access
• Vulnerability Management: Identifying, assessing, and
mitigating security vulnerabilities in software, hardware,
and systems to reduce the risk of exploitation by attackers.
• Intrusion Detection and Prevention: Monitoring network
traffic and system activities to detect and respond to
suspicious or malicious behavior, as well as implementing
measures to prevent unauthorized access and attacks.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 4 4

 Cybersecurity
• Incident Response: Developing and implementing plans
and procedures to effectively respond to and mitigate the
impact of security incidents, breaches, or compromises
• Security Awareness and Training: Educating users and
employees about cybersecurity best practices, policies, and
procedures to promote a culture of security and minimize
human errors and vulnerabilities.
• Cybersecurity is a critical aspect of modern-day technology
infrastructure and is essential for protecting sensitive
information

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 5 5

 Cybersecurity
• Maintaining trust and confidence in digital systems, and
safeguarding individuals, organizations, and societies from
cyber threats and attacks
• It requires a comprehensive and proactive approach that
involves continuous monitoring, assessment, adaptation,
and collaboration among stakeholders to stay ahead of
evolving cyber risks and challenges

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 6 6

 Applications of ML in Cyber Security
• Anomaly Detection:
• ML algorithms analyze normal network behavior and identify anomalies or
suspicious activities, helping detect potential security threats or breaches.
• Intrusion Detection Systems (IDS):
• ML is used to develop advanced IDS that can identify and respond to different
types of network intrusions, adapting to evolving attack patterns.
• Malware Detection:
• ML models analyze patterns in file structures and behaviors to identify and
prevent the spread of malware, viruses, and other malicious software
• Phishing Detection:
• ML algorithms are employed to recognize patterns in emails, websites, or
communication behaviors indicative of phishing attacks, helping protect
against social engineering threats

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 7 7

 Contd…
• User Behavior Analytics (UBA):
• ML models analyze user activities to establish a baseline of
normal behavior
• Deviations from this baseline may indicate compromised accounts
or insider threats
• Vulnerability Management:
• ML assists in identifying potential vulnerabilities in systems and
applications by analyzing historical data and patterns, enabling
proactive security measures
• Predictive Analysis:
• ML algorithms predict potential security incidents by analyzing
historical data, enabling organizations to take preventive actions
before threats escalate

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 8 8

 Contd…
• Security Information and Event Management (SIEM):
• ML enhances SIEM systems by automating the analysis of
vast amounts of security data, allowing for quicker
identification of security events
• Automated Threat Response:
• ML enables automated response mechanisms that can
rapidly detect and mitigate security threats without human
intervention
• Fraud Detection:
• ML is employed in financial and e-commerce sectors to
identify fraudulent activities by analyzing transaction
patterns and user behavior

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 9 9

 Contd…
• Network Traffic Analysis:
• ML models analyze network traffic in real-time to identify
patterns associated with malicious activities, providing insights
for network security
• Summing-up:
• Machine learning plays a crucial role in fortifying cybersecurity
measures by providing advanced threat detection, real-time
analysis, and proactive defense mechanisms across various
domains.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 10 10

 Relevance of Cybersecurity
• In the current digital landscape:
• The importance of cybersecurity cannot be overstated
• As technology continues to advance:
• businesses, organizations, and individuals are becoming
increasingly interconnected, relying on digital platforms for
communication, transactions, and data storage
• This heightened connectivity:
• while offering numerous benefits, also brings about significant
cybersecurity challenges

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 11 11

 Cybersecurity is crucial for several reasons
• Protecting Sensitive Information:
• Cyberattacks aim to compromise and exploit sensitive
information, including personal data, financial records, and
intellectual property
• Robust cybersecurity measures are essential to safeguard this
information from unauthorized access or theft.
• Ensuring Business Continuity:
• Organizations heavily depend on digital infrastructure for daily
operations
• Cybersecurity safeguards systems and networks, ensuring
uninterrupted business continuity by preventing disruptions caused by
cyber threats.
• Preserving Customer Trust:
• Security breaches can erode customer trust
• Implementing strong cybersecurity measures not only protects client
data but also demonstrates a commitment to privacy and security,
fostering trust and loyalty.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 12 12

 Contd…
• Mitigating Financial Risks:
• Cyberattacks can result in financial losses, ranging from the costs of
remediation to potential legal liabilities.
• Investing in cybersecurity helps mitigate these risks and safeguard an
organization's financial well-being.
• Adapting to Evolving Threats:
• The digital threat landscape is dynamic, with cyber threats constantly
evolving.
• Cybersecurity measures are essential to staying ahead of emerging
threats, adapting defenses to address new vulnerabilities and attack
vectors.
• Supporting National Security:
• Cybersecurity is integral to national security, as critical infrastructure sectors
such as energy, transportation, and healthcare are increasingly reliant on
digital technologies.
• Protecting these sectors from cyber threats is essential for the overall security
of a nation.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 13 13

 Contd…
• In summary:
• Cybersecurity is paramount in our digital age to protect sensitive
information, ensure business continuity, preserve trust, mitigate
financial risks, adapt to evolving threats, and contribute to
national security.
• Proactive and comprehensive cybersecurity strategies are crucial
for individuals, businesses, and governments alike to navigate the
digital landscape securely.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 14 14

 Brief History Machine Learning

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 15 15

 What is Machine learning (ML)?

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 16 16

 What is Machine Learning (ML)?
• Machine Learning (ML) is a subfield of artificial
intelligence (AI) that focuses on the development of
algorithms and statistical models that enable computers to
perform tasks without explicit being programmed.
• The essence of machine learning lies in the ability of
machines to learn from data and improve their
performance over time.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 17 17

 Classical VS Modern ML
Classical Machine Learning Modern Machine Learning

Introduction to classical ML concepts. Introduction to modern ML concepts.

Historical development and key milestones. Evolution of deep learning and neural networks.

Algorithms Deep Learning

Supervised learning algorithms (e.g., linear
Introduction to neural networks.
regression, logistic regression).
Unsupervised learning algorithms (e.g., k-means - Deep neural networks, architectures (e.g., CNNs,
clustering, hierarchical clustering). RNNs).

Ensemble methods (e.g., random forests, boosting). - Backpropagation algorithm.

Evaluation Metrics Frameworks and Libraries

Accuracy, precision, recall, F1-score for - Introduction to popular ML frameworks (e.g.,
classification problems. TensorFlow, PyTorch).
Mean Squared Error (MSE), R-squared for
- Hands-on examples using these frameworks.
regression problems.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 18 18

 Contd…
Feature Engineering Transfer Learning

- Importance of feature selection and

- Leveraging pre-trained models for new tasks.
extraction.

- Fine-tuning and adapting models for specific

- Handling missing data and outliers.
domains.

Reinforcement Learning

- Basics of reinforcement learning.

- Applications and challenges.

Ethical Considerations

- Discussion on the ethical implications of ML.

- Bias, fairness, and responsible AI.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 19 19

 Where to collect data?
• We can collect date from:
• Google Dataset Search
• UCI data repository
• Custom data/ Own Data preparation/generation.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 20 20

 Data pre-processing stages
• Data preprocessing is a crucial step in machine learning
that involves cleaning and transforming raw data into a
format suitable for training models
• The most commonly used data preprocessing stages in
machine learning include:
• Handling Missing Data:
• Identifying and addressing missing values is essential.
• Common strategies include removing instances with
missing values, imputing missing values (e.g., using
mean or median), or using more advanced imputation
techniques.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 21 21

 Contd…
• Data cleaning:
• Cleaning involves addressing outliers, errors, or
inconsistencies in the data
• This may include
• Removing duplicates, NaN, null values …
• Handling anomalies, or
• Correcting errors to ensure data quality
• Data Normalization (Scaling):
• Scaling features to a similar scale helps prevent certain
features from dominating others
• Common techniques include
• Min-Max scaling,
• Z-score normalization, and
• robust scaling
Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 22 22
 Contd…
• Handling Categorical Data:
• Machine learning algorithms often require numerical input
• Categorical data (e.g., text or nominal values) needs to be
encode
• Common techniques include
• one-hot encoding,
• label encoding, or
• using embedding for more complex data types
• Feature Engineering:
• Creating new features or transforming existing ones to improve
model performance
• This can include
• Deriving new features,
• Combining features, or
• Applying mathematical transformations

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 23 23

 Contd…
• Data Splitting:
• Splitting the dataset into training and testing sets
• This helps evaluate model performance on unseen data
• Common splits include:
• The training set for model training and
• The testing set for model evaluation
• Handling Imbalanced Data:
• In cases where one class significantly outnumbers another,
• Balancing techniques may be applied
• This includes
• Oversampling the minority class,
• undersampling the majority class, or
• Using synthetic data generation methods (SMOTE).

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 24 24

 Contd…
• Data Augmentation:
• For image and signal processing tasks:
• Data augmentation involves generating additional
training samples by applying transformations like:
• Rotation, scaling, or
• Flipping to existing data, etc.

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 25 25

 Learning paradigm Definitions

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 26 26

 Algorithms

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 27 27

 Supervised learning algorithms
• Linear regression
• Logistic regression
• Support Vector Machine(SVM)
• K-Nearest Neighbor (KNN)
• Decision Tree
• Random Forest

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 28 28

 Unsupervised Learning Algorithms
• K Means Clustering
• Hierarchal Clustering
• DBSCAN
• Principal Component Analysis (PCA )

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 29 29

 Reinforcement Learning Algorithms
• Q-Learning
• SARSA
• Monte Carlo
• Deep Q network

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 30 30

 Approaches

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 31 31

 Training

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 32 32

 Types of problem solved with these techniques

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 33 33

 Applications

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 34 34

 Contd..

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 35 35

 Supervise Learning paradigm

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 36 36

 Unsupervised Learning paradigm

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 37 37

 Reinforcement Learning

Capt. Mehari K (Ph.D) Ethiopian University, Engineering College 38 38