## 3 Sharing ML Models as Cyber Threat Intelligence
### Sharing ML Models as Threat Intelligence
Subsequently, we processed the log files with Zeek Analysis Tools (ZAT) 0.4.1 (cfr. [[https://pypi.org/project/zat/](https://pypi.org/project/zat/)]([https://pypi.org/project/zat/](https://pypi.org/project/zat/)), accessed on 24 February 2021). For the purpose of these experiments, we only used the conn.log file, and removed the source and destination IP addresses, i.e., the 'id.orig_h' and 'id.resp_h' fields, as well as the 'uid' field representing the unique identifier of the connection, and the 'history' field describing the state history of the connection. Other categorical fields were label-encoded so that each of the 13 remaining fields has a numerical representation. The outcome of this pre-processing is a data set with 6,841,238 feature vectors, of which 1,082,442 indicate a DDoS attack and 5,758,796 benign traffic. The labeling was done based on the time of day and the IP addresses involved in the attack, as documented on the data set's website. We created stratified splits of the data set to use 80% for training and 20% for testing, but also confirmed the accuracy of the obtained models through 10-fold cross-validation. We trained several traditional ML models to recognize DDoS attacks with Scikit-Learn 0.23.2, and DL using Tensorflow 2.4.1. Later on, we will elaborate on how to cryptographically protect these ML and DL models. #### 3.3.2 Sharing a Decision Tree Model and an Adversarial Example

The ML-based threat intelligence sharing story begins with a simple example. We trained a 'DecisionTreeClassifier' model, enforcing a maximum depth of 2. The outcome of the training phase is depicted in Figure 3. A decision is made on two fields:'resp_bytes' indicating the number of payload bytes sent by the responder, and 'orig_pkts' counting the number of packets sent by the originator. The confusion matrix is shown in Figure 4, illustrating an almost perfect classification (i.e., an f1 score is 0.99996, and an average 10-fold cross-validation score of 0.99998). The decision tree model is rather small when serialized to disk in Joblib format, i.e., only 1713 bytes. Figure 3: Decision tree with maximum depth 2. A security analyst could share this model through MISP in a similar manner as depicted in Figure 1, though this would be rather naive. Not only was the model trained and tested on a single data set with only a limited number of DDoS attack types, it is also fairly trivial to construct an adversarial example that can evade DDoS detection. The attacker only needs to trigger the target to reply with a payload having more than 935 bytes. See Table 1 for a feature vector example of a DDoS connection correctly classified by the decision tree model as malicious. This is the result of a bi-directional flow of 10 packets encapsulating an HTTP request and response in the payloads of the packets, as shown in Listings 5 and 6. ```
1 GET/MTP/1.0
2 Accept:/*/
3 Accept-Language:en
4 Reference:[[http://18.218.83.150](http://18.218.83.150)]([http://18.218.83.150](http://18.218.83.150))
5 User-Agent:Opera/9.80(WindowsWT5.2;U;ru)Presto/2.5.22 Version/10.51
6 If-Modified-Since:Mon,29 Oct200711:59:59 GMT
7 Cache-Control:no-cache
88 tox:18.218.83.150
```
Listing 5: HTTP request for the DDoS-HOIC attack. ```
1 HTTP/1.1200 MK
2 Date:Wed,21 Feb201818:52:44 GMT
3 Server:Apache/2.4.18(Ubuntu)
44 Jray:Accept-Encoding
5 Content-Length:745
6 Connection:close
7 Content-Type:text/html;charset=UTF-8
8
9<!DOCTYPEHTML.PUBLIC~/~/HQC/DTD HTML3.2 Final/EN>
10<html>
11<head>
12<title>Index of /</title>
13</head>
14<body>
15<hl>Index of /</nl>
16...
```
Listing 6: HTTP response for the DDoS-HOIC attack. To bypass detection, the DDoS attack could trigger a bigger payload in the HTTP response, possibly by requesting a different URL. To confirm, we captured the PCAP packets after submitting the same HTTP request and returning the same and a slightly larger HTTP response. After replaying