# Applications of Machine Learning in Cyber Security: A Review
## 4 Dataset Availability and Assessment  
The earlier sections establish that all of the previously mentioned attacks can be in part identified and/or prevented with the use of ML/AL, apart from social engineering. Table 3 shows the prevalence of various AI/ML modeling approaches in the corpus of reviewed studies cited here, excluding the 29 studies that did not have a relevant methodology section. It is important to note that the reported accuracies of 84% to 99% in the studies reference previously known attacks. When unknown attacks are in question, detection rates drop significantly to 3.2-14.7% according to [52]. Additionally, false positives are a well-documented issue. In the domains of ML and AI, the selection of an appropriate dataset is pivotal, necessitating a thorough evaluation across multiple dimensions such as attack diversity, traffic realism, dataset balance and quality, labeled data availability, and the dataset's size and complexity. Thus, a review of existing datasets and their applicability is necessary for further development in this cross-disciplinary domain. In the last 20 years, several other datasets have also been synthesized or recorded to assist in prognostic and diagnostic analytics. DARPA contains a set of intrusion detection data, including LLDOS-1.0 and LLDOS2.0.2, which consist of connections between source and destination IP addresses. Traffic and various attack data are categorized by the MIT Lincoln Laboratory and are used to evaluate attacks and detect intrusions. However, it is considered outdated. CAIDA contains distributed denial of service (DDoS) attack traffic and regular traffic traces, including unspecified traffic from a DDoS attack in 2007. CTU-13 is an extensive dataset that includes botnet traffic captured by a Czech university in 2011 and is useful for malware analysis. It covers a moderate diversity of attacks but offers realistic labeled data. The CTU-13 dataset carves a niche in botnet detection with its focused coverage on botnet traffic, offering a unique perspective and detailed stages of botnet activity. These are beneficial for dynamic threat detection models, despite its narrower breadth of attack types compared to others. MAWI includes data retrieved from Japanese network research institutions and comprises labels that identify traffic deviation. ISCX'12 is produced by the Canadian Institute for Cybersecurity and contains 19 features; 19.11% of the traffic belongs to distributed DDoS attacks. Bot-IoT contains reliable traffic and simulates the internet of things in a realistic network environment in the Cyber Range Lab of UNSW Canberra. It contains DDoS, DoS, OS and service scan, keylogging, and data exfiltration attacks, with the DDoS and DoS attacks further organized based on the employed protocol. ISOT'10 contains a mix of malicious and non-malicious data traffic and was created during the Information Security and Object Technology (ISOT)  
Figure 9: Social engineering-based infection process and consequences. research at the University of Victoria. Similarly, the modern yet domain-specific SWaT and IoT-23 datasets present network data for SCADA and IoT systems, respectively, making them very niche for general utility. UNSW-NB15 was created using the IXIA PerfectStorm tool in the Cyber Range Lab of UNSW Canberra and includes a mix of contemporary synthetic attack activities and behaviors. This dataset contains 49 features and 9 attack types. The TCPDUMP tool is executed to simulate and capture 100 GB of traffic, and the ARGUS and Bro-IDS tools are operated with 12 models to generate 49 features in classifying the data. The UNSW-NB15 and CICIDS2017/2018 datasets cater to contemporary cyber security challenges with a high diversity of modern attack types and a very realistic simulation of network traffic, respectively. UNSW-NB15, with its balance between complexity and manageability, presents a rich environment for deep learning models, albeit with potential computational demands.