## 3 Sharing ML Models as Cyber Threat Intelligence
### Sharing ML Models as Threat Intelligence
```
1{
4\"description\": \"AmicslassifiedPCAPtrace\",
5\"disable.correlation\": true,
6\"misp-attribute\": \"attachment\",
7\"multiple\": true,
8\"ui-priority\": 0
9},
10\"m_Lerror_type\":{
11\"description\": \"Typeofbinaryclassificationerror\",
12\"misp-attribute\": \"text\",
13\"same_default\": [ \"false_positive\", \"false_negative\" ],
14\"multiple\": false,
15\"ui-priority\": 1
16},
17\"m_label\":{
18\"description\": \"ClassificationlabeloftheMLmodel\",
19\"misp-attribute\": \"text\",
20\"same_default\": [ \"true\", \"false\" ],
21\"multiple\": true,
22\"ui-priority\": 1
23}
24},
25\"description\": \"PCAPtraceforMLIDSclassification\",
26\"meta-category\": \"network\",
27\"name\": \"m_label\":{
28\"required\": [ \"pcap\", \"m_label\", \"m_Lerror_type\" ],
29\"uuid\": \"4c9 eb65e-5 eb6 leb-ae93-0242 ac130002\",
31\"version\": 1
32 The MISP event example illustrates a deep learning autoencoder [47] model serialized in the HDF5 encoding, which attempts to distinguish benign and malicious traffic, and sample Python code to process and classify the input data. The event is augmented with an object describing a benign PCAP example that is misclassified as a false positive. The autoencoder in Figure 1 is merely used for illustration purposes. This neural network model learns a compressed encoding of a normal data set without anomalies in an unsupervised manner. Once this neural network has learned how to represent benign behavior, it can reconstruct the original input from the compressed feature vector as depicted in Figure 2, and detect anomalies which typically have a higher reconstruction error than normal input samples. Note though that the purpose of this work is not to improve the accuracy of a particular traditional ML or DL model, but rather to analyze the advantages and drawbacks of sharing ML models. Indeed, sharing such models can be done for a variety of use cases that the security community is interested in (e.g., malware and APT analysis, intrusion detection, application log auditing, and user and entity behavior analytics). Even for the same security use case, one can use different kinds of traditional ML or DL models, for example, classification models trained in a supervised manner to recognize particular network attacks. In the following section, we will provide some examples of ML models and adversarial examples that could be shared within a security community in a similar manner. Figure 1: MISP objects for ML (machine learning) model based threat intelligence sharing. Figure 2: Feed-forward autoencoder for anomaly detection. ### ML and DL Models for DDoS Detection

Our goal is not to find the best ML or DL models, nor to suggest any methods to adversarially train these models. We consider this out of scope for this work as this is a fast moving research area for which we refer to relevant related work [48, 49, 50]. Our aim is to illustrate a scenario of ML models and associated artifacts being shared in a community of collaborating security analysts. We will illustrate our approach with a distributed denial of service (DDoS) detection use case. For this purpose, we replayed the PCAP files from the CSE-CIC-IDS2018 [51] (cfr. [[https://www.unb.ca/cic/datasets/ids-2018.html](https://www.unb.ca/cic/datasets/ids-2018.html)]([https://www.unb.ca/cic/datasets/ids-2018.html](https://www.unb.ca/cic/datasets/ids-2018.html)), accessed on 24 February 2021) cyber defense data set, more specifically those that were originally captured on Wednesday, February 21, 2018. On this day, two DDoS attacks were carried out using the high orbit ion cannon (HOIC) and low orbit ion cannon (LOIC) tools on the TCP and UDP network layers. #### 3.3.1 Pre-Processing the PCAP Files

We used Zeek 3.2.3 (cfr. [[https://zeek.org](https://zeek.org)]([https://zeek.org](https://zeek.org)), accessed on 24 February 2021) to replay the 447 PCAP files and process the network traffic. Zeek then generates various structured log files (e.g., conn.log, http.log, dns.log, ssh.log, etc.).