Reliable Feature Selection for Adversarially Robust Cyber-Attack
  Detection
João Vitorino Miguel Silva Eva Maia Isabel Praça
The growing cybersecurity threats make it essential to use high-quality data
to train Machine Learning (ML) models for network traffic analysis, without
noisy or missing data. By selecting the most relevant features for cyber-attack
detection, it is possible to improve both the robustness and computational
efficiency of the models used in a cybersecurity system. This work presents a
feature selection and consensus process that combines multiple methods and
applies them to several network datasets. Two different feature sets were
selected and were used to train multiple ML models with regular and adversarial
training. Finally, an adversarial evasion robustness benchmark was performed to
analyze the reliability of the different feature sets and their impact on the
susceptibility of the models to adversarial examples. By using an improved
dataset with more data diversity, selecting the best time-related features and
a more specific feature set, and performing adversarial training, the ML models
were able to achieve a better adversarially robust generalization. The
robustness of the models was significantly improved without their
generalization to regular traffic flows being affected, without increases of
false alarms, and without requiring too many computational resources, which
enables a reliable detection of suspicious activity and perturbed traffic flows
in enterprise computer networks.