# Cybersecurity Threats and Their Mitigation Approaches Using Machine Learning--A Review
## 2 Background
### Cyber-Attacks and Security Risks
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Defense Technology** & \multicolumn{2}{c}{**Categories of Defense**} & \\ \multicolumn{2}{c}{**Technologies Used Against**} & \multicolumn{2}{c}{**Description of Defense Categories**} \\ \hline \hline \multirow{6}{*}{Cryptography is a way to change data in such a way that only the intended receiver has the information to extract information from the changed form (encrypted data). It is the most used method to secure data.} & \multirow{6}{*}{Identity-based cryptography [25]} & This is a public key generated using identification-based information, e.g., email address. The generation is processed by a trusted certifying authority. This is an active research area, to overcome the inconveniences of this cryptography against malware attacks. \\ \cline{2-3}  & Quantum cryptography [26] & In this cryptography, for the two parties, sender and receiver, the transmission generates cryptographic keys to encrypt data, following the laws of quantum mechanics. Hence, this encryption is not hackable. \\ \hline \hline \multirow{6}{*}{Firewall is the prevalent perimeter defense technology that controls network traffic (input data and outgoing data). It decides whether the data will go through or not based on a set of preset rules [27]. Despite the sophistication of firewalls, they can fail when a compromised but previously trusted system sends any request, and the attacking machine uses a trusted system’s identity. & 1. Network-layer firewall or packet filtering works at the network layer controlling data flow but has the drawback of having static rules that are not able to block undesirable data. Hence, it cannot block malware payload. 2. Application-layer firewall controls the flow of input, output and system calls by an application. This firewall makes the tempering of internal components by malware difficult. 3. Proxy servers work as a mediator between outside connections and internal components of a system and hence can hinder the tampering of these components by malware. \\ \hline \hline \multirow{6}{*}{Network forensics [28] is the process of eavesdropping on the internet, Ethernet or TCP/IP to learn the attack pattern. There are numerous network forensics tools.} & 1. eMailTrackerPro investigates the header of an email to look for an IP address, to find the sender. 2. Web browser traffic forensic tool, SmartWhools, can provide all available information about an IP address. 3. WebHistorian analyzes a website’s URL. 4. Index.datanalyzer analyzes the browsing history, cache and cookies. 5. In the wireless LAN interface and network interface, packet intercepts can be caught using AirPcap and WinPcap, respectively. 6. Honeypots are mock resources that trap the attacker and gather information. \\ \hline \hline \multirow{6}{*}{Access control [29] differentiates between users and controls resource access of the user based on the user’s preset rights. It provides authentication, authorization and accountability.} & 1. Two broad divisions of access control, used in malware defense, are capability-based access control and the access control list-based approach. 2. Three access control models are Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role-Based Access Control (RBAC). \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Defenses to protect data against malware. Phishing is the practice of sending fraudulent communications or social engineering, which is mostly spread through emails. The goal is to steal the victim's data, such as credit card numbers and login credentials. As part of a larger operation as an advanced and persistent threat, this assault is frequently used to achieve a foothold in government or business networks. Spear phishing is targeted to particular individuals or organizations, governments or military intelligence to acquire trade secrets, financial gains or information. Whale phishing is mostly aimed at high-profile employees such as a CFO or CEO to gain vital access to a company's sensitive data.