Team Aladdin — The journey this week!
By: Citlalin Galvan
Tags: Machine Learning, Dataset, Data Science

Source: androidauthority.com

This week we are back at work with our research and the group consisting of, Vivian Nguyen, Huy Nguyen, Tien Tran, and Citlalin Galvan. In the first week we focused on malicious apk files and their behaviors inside android phones. This week we wanted to go broader and see the kind of data that has been collected previously. As we looked for the data, we were surprised at how much data is out there, but how little information there is for those datasets especially on data pertaining to cyber security.

Mission Statement

Do data quality analysis on existing data sets and publish a report with a program for others to gain knowledge.

One of the biggest problems in Machine Learning is the quality of training datasets in Cyber Security. The available data signals that the focus is quantity over quality datasets, but someone should still check those datasets and see what is important and what can be discarded. That is where we come into play!

The questions that we are working to get answers for this week are:

How to analyze the data with pandas? How can we see if the data is still relevant? How to profile the data? How to create a data monitoring scorecard?

Our Progress

Our obstacle when it came to analyzing the data in the datasets was that no one in the team had any prior experience with data science and analysis. So, we made it our first priority to research as much as we could on the same to gain as much knowledge as we can. We were able to find two great courses that were really helpful for us — Data Camp and Edx. These were greatly useful for us to learn on how to analyze datasets using python and pandas.

To not feel overwhelmed with how much information there is out there and everything we wanted to do with the project and report, we broke down the process of analyzing into smaller, easier to handle steps.

Data Requirements — Even though there is a lot of data shared online, we had to focus on data related to cybersecurity. That proved to be a challenge all on its own. Not many companies are allowed to share data related to security, and open source projects were limited on information. Data Collection — In our pursuit to find any data set related to security, we stumbled upon SecRepo, a website that has loads of samples of security related data that would be very useful for our project. Data Processing — Log files and JSON files found inside SecRepo were converted to CSV files for clarity and ease of analysis. Also, the python tool for data analysis, Pandas, facilitates a lot of manipulations on CSV files. Refer to Log to CSV File Converter Program below for more information. Data Cleaning — This step is where we check what features are important and learn their essence, since many of the datasets do not have any features labeled.

Research Performed this week

To network and connect with companies and people leading in this field, we reached out to owner of SecRepo, Mike Sconzo, on how we could contribute to his open source project and on ways to improve the quality of the data sets found in his website. His website contains Network, Malware, and System datasets he created and has found from third party websites.

A good place to study on dataset analysis was UC Irvine’s DataSet Repository. They have very detailed analysis reports on every data set and it is open to the public to view. It is a great example of the kind of analysis we want to do for our own dataset report.

We are currently on the process of emailing two professors who work on adversarial machine learning and will be asking for their guidance and asking for resources that could help us with cybersecurity using machine learning.

Log to CSV File Converter Program

LogtoCsvConverter.py(https://github.com/cyberdefenders/MachineLearning)

In this program, we convert a log file into a CSV file. First, we download the log file, and check the file path. Once the program runs, we can input the file path. We then wait a bit while the file gets converted and once it is converted it will ask you to rename the file to your preferred name. You can now see your new CSV file inside the current path of the code. We have it easy and user friendly, so that everyone can use the converter from command line.

Plans for Week 3

Now that we can read the files in pandas, we will focus on analyzing the data we have downloaded from SecRepo. We will focus on how to clean up the data by learning what the features mean so we can label them and what are the primary features we should look at.

Check out our Github repository!

References