# Applications of Machine Learning in Cyber Security: A Review
## 4 Dataset Availability and Assessment
The UNSW-NB 15 dataset [53] has nine attack classes: analysis, backdoor, DoS, exploits, fuzzers, generic, reconnaissance, shellcode, worms, and a normal class. It was created from 100 GB of normal and modern attack traffic by the Australian Centre for Cyber Security using the IXIA tool. CICIDS2017/2018, distinguished by its comprehensive attack types and very high realism, requires significant computational resources due to its vast size, but it offers extensive labeled data for a wide array of supervised learning applications. Another dataset that stood out was CICCDoS2019 [54]; one of the most recently updated. However, it was rejected for being designed only for DoS attacks, making it unsuitable for testing on a wide variety of attacks. KDD99 Cup is a widely utilized dataset that has 41 features for evaluating anomaly detection. Through this dataset, attacks are categorized into four categories, namely probing, remote-to-local (R2L), user-to-remote (U2R), and DDoS. NSL-KDD has removed redundant records from KDD99 and some inherent issues eliminating bias toward frequent records. The NSL-KDD dataset, recognized for its moderate diversity of attacks and improvement over its predecessor KDD'99, offers a balanced and qualitative dataset with reduced redundancy, making it suitable for ML applications without extensive preprocessing. It stands out for its manageable size and labeled data, which support supervised learning and facilitate the training of ML models with relative ease. NSL-KDD is similar to UNSW-NB 15 and shares the same strengths. However, it has older traffic and attack types and is known to be more unbalanced [53]. Figure 10 showcases two of the most important factors in the comparison of datasets: their age versus the labeled attack categories, along with any subgroups presented. Clearly, \begin{table}
\begin{tabular}{l l} \hline \hline
**Modeling Approach** & **Prevalence (\%)** \\ \hline SVM & 20.83 \\ RNN & 8.33 \\ Regression methods & 4.17 \\ Isolation, random forest, XGBoost & 19.44 \\ Autoencoders & 2.78 \\ Unspecified classification & 9.72 \\ Digital twins & 1.39 \\ Multiobjective optimization & 1.39 \\ Hybrid models & 18.06 \\ Decision trees & 13.89 \\ KNN & 4.17 \\ Generative AI & 4.17 \\ Ensemble methods & 15.28 \\ Bayesian networks & 5.56 \\ NN & 9.72 \\ CNN & 18.06 \\ DNN & 25 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Summary of ML/AI modeling methods and prevalence inthe cited literature. 78% of the datasets are 10 or more years old, while there is a trend for newer datasets to provide fewer attack labels with more varied scenarios or sub-groups of individual attack algorithms or methods (e.g., specific malware, specific exploit, etc.) MAWI and SWaT are not labeled and are therefore suited to exploratory anomaly detection using ML/AI algorithms. The remainder are labeled, allowing for classification methods. As the body of available datasets is growing, it would be expected that the ML/AI approaches would be also evolving. However, one limitation is that all of the aforementioned datasets define their own features, with some directly measured and some derived. It is almost impossible to attempt to unite the available datasets in a larger corpus due to the diversity of the features. Also, the derivation methods are not always well defined; in some cases, the originally measured feature is not published as part of the dataset; only the derivative. As a result, any new ML or AI approaches need to identify a dataset most suitable for the problem at hand. Another limitation is of course the dataset's age, which would not include the latest attacks. Finally, and perhaps most importantly, there is no consensus on which features are indeed relevant for certain attacks or attacks in general. In this review, we argue, however, that certain characteristics can differentiate datasets and make them more appropriate for use in ML and AI.