# Cybersecurity Threats and Their Mitigation Approaches Using Machine Learning--A Review
## 3 Machine Learning Techniques in Cybersecurity
### Unsupervised Learning  
The main goal of unsupervised learning, also known as data-driven learning, is to uncover patterns, structures or relevant information in unlabeled data [121]. Risks such as malware can be disguised in a variety of ways in cybersecurity, including changing their behavior dynamically to escape detection. Clustering techniques, which are a form of unsupervised learning, can aid in the discovery of hidden patterns and insights in datasets, as well as the detection of indicators of sophisticated attacks. In addition, clustering algorithms can effectively spot anomalies and policy violations, recognizing and eliminating noisy occurrences in data, for example. K-means [122] and K-medoids [123] are clustering \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Algorithm** & **Objective** & **Dataset** & **Accuracy** & **Reference** \\ \hline \multirow{4}{*}{Naive Bayes} & Can be used to analyze continuous and discrete values. Features are evaluated in a mutually exclusive fashion, making it relatively fast, thereby finding applicability in real-time decision making. & KWeka package, KDD 1999 & 90–99\% & [103] \\ \cline{3-6}  & \multirow{2}{*}{\begin{tabular}{} \end{tabular} } & KDD 1999 & 97\% & [93] \\ \cline{3-6}  & & TCP data collected from the & \\  & & Dartmouth University campus’ wireless network & 93\% & [94] \\ \hline \multirow{4}{*}{Support Vector Machines} & Effective in high-dimensional spaces. Relatively memory-efficient. Numerical and categorical features. & DARPA & 95.11\% & [95] \\ \cline{3-6}  & \multirow{2}{*}{\begin{tabular}{} \end{tabular} } & KDD-99 & 93–99\% & [96] \\ \cline{3-6}  & & DARPA 1998 & 75–100\% & [97] \\ \hline \multirow{4}{*}{Decision Tree} & Requires little data preparation. Can be used to analyze continuous and discrete data. Can be generalized using dynamic tree-cut parameters. & TCP data collected from the & \\  & & Dartmouth University campus’ wireless network & 97\% & [94] \\ \cline{3-6}  & \multirow{2}{*}{\
\begin{tabular}{} \end{tabular} } & 3000 behavior events collection & 84.7\% & [99] \\ \cline{3-6}  & & KDD dataset & 94.7\% & [101] \\ \hline Sequential Pattern Mining & Frequent sequential patterns for a frequency support measure. & DARPA 1999 and 2000 & 93\% & [104] \\ \hline DBSCAN & Identify outliers, separate clusters of high density from clusters of low density. & KDD-99 & 98\% & [105] \\ \hline ADMIT & Not reliant on a lot of labeled data. Uses a dynamic clustering technique Modified form of K-means clustering. & Data collected from UNIX users from Purdue University & 80\% & [106] \\ \hline \multirow{4}{*}{A priori algorithm} & The resulting rules are intuitive. Does not require labeled data as it is fully unsupervised. & Nine different-sized custom databases & 70–100\% & [107] \\ \cline{3-6}  & \multirow{2}{*}{
\begin{tabular}{} \end{tabular} } & Real-time network anomaly detection. & KYOTO & 95.6\% & [108] \\ \hline Random forest & Multi-class classification of network traffic threats. & KDD’99 Cup & 99.0\% & [109] \\ \hline Extra-tree classifier (ETC) & Multi-class classification of DoS, probe, R2L and U2R. & KDD’99 Cup & 99.51\% & [110,111] \\ \hline Radial Basis Function (RBF) & Comparative classification between lazy, eager learning and deep learning. & DARPA & 97.41\% & [108,112] \\ \hline Random forest & Comparative classification between lazy, eager learning and deep learning. & UNSWNB15 & 95.43\% & [113,114] \\ \hline Random forest & Android malware detection. & DREBIN & 94.33\% & [115, 116, 117] \\ \hline XGBost & Classification of spam and ham from emails. & ENRON Spam & 98.67\% & [118, 119, 120] \\ \hline \end{tabular}
\end{table} 
Table 3: Shallow machine learning algorithms Used in cybersecurity. algorithms used for partitioning, while single linkage [124] and complete linkage [125] are some of the most widely utilized hierarchical clustering methods in various application sectors.