# Cybersecurity Threats and Their Mitigation Approaches Using Machine Learning--A Review
## 3 Machine Learning Techniques in Cybersecurity
\begin{table}
\begin{tabular}{c p{284.5 pt}} \hline \hline
**Dataset** & **Description** \\ \hline MAWI [55] & A cybersecurity dataset regulated by Japanese network research institutions and academic institutions that is commonly used to detect and assess DDoS threats using machine learning techniques. \\ \hline CERT [56] & The purpose of creating user activity logs was to validate insider-threat detection algorithms in this dataset. Based on machine learning, it can be used to track and evaluate user behavior. \\ \hline Bot-IoT [57] & This is a dataset that includes authentic and simulated Internet of Things (IoT) network traffic, as well as various assaults for network forensic analytics in the IoT space. Bot-IoT is primarily used in forensics to assess reliability using multiple statistics and machine learning techniques. \\ \hline DGA [58] & The Alexa Top Sites dataset reliably hosts domain names that are benign. Malicious domain names are collected from OSINT and DGArchive. These datasets find perfect application in DGA botnet detection or domain classification using automated ML models. \\ \hline CTU-13 [59] & This is a labeled malware dataset including background traffic, botnet and normal user activities, which was captured at CTU University, Czech Republic. CTU-13 is used for data-driven malware analysis using machine learning techniques and to evaluate the standard malware detection system. \\ \hline CAIDA [60] & The CAIDA’07 and CAIDA’08 datasets contain DDoS attack traffic and normal standard traffic history. They are primarily used to assess machine learning-based DDoS attack detection models and to spot internet DOS activities. \\ \hline CIC-DDoS2019 [61] & The Canadian Institute for Cybersecurity has compiled a database of historical DDoS assaults. CIC-DDoS is an excellent network traffic behavioral analytics tool for detecting DDoS attacks using machine learning approaches. \\ \hline ISCX’12 [62] & This dataset contains 19 features and 19.11\% of the network traffic belongs to DDoS attacks. ISCX’12 was documented at the Canadian Institute for Cybersecurity and is well known for its use in the evaluation of the effectiveness of machine learning-based network intrusion detection modeling. \\ \hline Malware [63] & This is a collection of malicious files from several malware-based datasets such as the Genome Project, VirusTotal, Virus Share, Comodo, Contagio, Microsoft and DREBIN. These datasets are commonly used for data-driven malware analysis and evaluation of existing malware detection systems utilizing machine learning techniques. \\ \hline EnronSpam [64] & Email-based datasets are difficult to collect because of privacy concerns. This dataset is a collection of emails with spam and ham classification. \\ \hline DREBIN [65] & Researchers have created these datasets from the Drebin project, which is publicly available, in order to encourage and improve research on Android malware. There are 5560 programs in this collection, spanning 179 different malware categories. The samples were collected between August 2010 and October 2012, and the MobileSandbox initiative made them freely available to cybersecurity practitioners. \\ \hline CDX 2009 Network USMA [66] & This dataset highlights the correlation found between IP addresses associated with the PCAP files to hosts that are found on the internal USMA network. Not all network modifications are reflected in this dataset. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Cont. priori algorithm [71]. In supervised learning, the models usually have class labels to verify the predictions. [PERSON], for example, uses probabilistic distribution to identify to which category a class label belongs. Decision trees create a tree-like structure based on a training set. For prediction, once the tree is built, any unknown record can be sorted based on the tree structure. Random forest [72] uses a similar approach, but instead of building one decision tree, it builds multiple decision trees and then uses a voting scheme to classify a record.