Cybersecurity data science: an overview from machine learning perspective. 

Scene 1

Cybersecurity data science: an overview 
from machine learning perspective

Iqbal H. Sarker1,2* , A. S. M. Kayes3, Shahriar Badsha4, Hamed Alqahtani5, Paul Watters3 and Alex Ng3

Introduction
Due to the increasing dependency on digitalization and Internet-of-Things (IoT) [1], 
various security incidents such as unauthorized access [2], malware attack [3], zero-
day attack [4], data breach [5], denial of service (DoS) [2], social engineering or phish-
ing [6] etc. have grown at an exponential rate in recent years. For instance, in 2010, 
there were less than 50 million unique malware executables known to the security 
community. By 2012, they were double around 100 million, and in 2019, there are 
more than 900 million malicious executables known to the security community, and 
this number is likely to grow, according to the statistics of AV-TEST institute in Ger-
many [7]. Cybercrime and attacks can cause devastating financial losses and affect 
organizations and individuals as well. It’s estimated that, a data breach costs 8.19 mil-
lion USD for the United States and 3.9 million USD on an average [8], and the annual

Abstract 
In a computing context, cybersecurity is undergoing massive shifts in technology and 
its operations in recent days, and data science is driving the change. Extracting security 
incident patterns or insights from cybersecurity data and building corresponding 
data-driven model, is the key to make a security system automated and intelligent. To 
understand and analyze the actual phenomena with data, various scientific methods, 
machine learning techniques, processes, and systems are used, which is commonly 
known as data science. In this paper, we focus and briefly discuss on cybersecurity data 
science, where the data is being gathered from relevant cybersecurity sources, and 
the analytics complement the latest data-driven patterns for providing more effec-
tive security solutions. The concept of cybersecurity data science allows making the 
computing process more actionable and intelligent as compared to traditional ones in 
the domain of cybersecurity. We then discuss and summarize a number of associated 
research issues and future directions. Furthermore, we provide a machine learning based 
multi-layered framework for the purpose of cybersecurity modeling. Overall, our goal is 
not only to discuss cybersecurity data science and relevant methods but also to focus 
the applicability towards data-driven intelligent decision making for protecting the 
systems from cyber-attacks.

Keywords: Cybersecurity, Machine learning, Data science, Decision making, Cyber-
attack, Security modeling, Intrusion detection, Cyber threat intelligence

© The Author(s) 2020. This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, 
adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and 
the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material 
in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material 
is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the 
permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creat iveco 
mmons .org/licen ses/by/4.0/.

Sarker et al. J Big Data            (2020) 7:41  
https://doi.org/10.1186/s40537-020-00318-5

*Correspondence:   
msarker@swin.edu.au 
1 Swinburne University 
of Technology, Melbourne, 
VIC 3122, Australia
Full list of author information 
is available at the end of the 
article

Page 2 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 2

Page 2 of 29
Sarker et al. J Big Data            (2020) 7:41

cost to the global economy from cybercrime is 400 billion USD [9]. According to Juni-
per Research [10], the number of records breached each year to nearly triple over 
the next 5 years. Thus, it’s essential that organizations need to adopt and implement 
a strong cybersecurity approach to mitigate the loss. According to [11], the national 
security of a country depends on the business, government, and individual citizens 
having access to applications and tools which are highly secure, and the capability 
on detecting and eliminating such cyber-threats in a timely way. Therefore, to effec-
tively identify various cyber incidents either previously seen or unseen, and intelli-
gently protect the relevant systems from such cyber-attacks, is a key issue to be solved 
urgently.
Cybersecurity is a set of technologies and processes designed to protect computers, 
networks, programs and data from attack, damage, or unauthorized access [12]. In 
recent days, cybersecurity is undergoing massive shifts in technology and its opera-
tions in the context of computing, and data science (DS) is driving the change, where 
machine learning (ML), a core part of “Artificial Intelligence” (AI) can play a vital role 
to discover the insights from data. Machine learning can significantly change the 
cybersecurity landscape and data science is leading a new scientific paradigm [13, 
14]. The popularity of these related technologies is increasing day-by-day, which is 
shown in Fig. 1, based on the data of the last five years collected from Google Trends 
[15]. The figure represents timestamp information in terms of a particular date in the 
x-axis and corresponding popularity in the range of 0 (minimum) to 100 (maximum) 
in the y-axis. As shown in Fig. 1, the popularity indication values of these areas are 
less than 30 in 2014, while they exceed 70 in 2019, i.e., more than double in terms 
of increased popularity. In this paper, we focus on cybersecurity data science (CDS), 
which is broadly related to these areas in terms of security data processing techniques 
and intelligent decision making in real-world applications. Overall, CDS is security 
data-focused, applies machine learning methods to quantify cyber risks, and ulti-
mately seeks to optimize cybersecurity operations. Thus, the purpose of this paper 
is for those academia and industry people who want to study and develop a data-
driven smart cybersecurity model based on machine learning techniques. There-
fore, great emphasis is placed on a thorough description of various types of machine 
learning methods, and their relations and usage in the context of cybersecurity. This

popularity
26-0a.14
26.Dec.14
26.Feb15
26.Apr.1S
26.Jun•
26-Aug-1S
26-0 ct.1S
26.Dee15
26-Feb16
26-Aør-16
26-Jun.16
26.Aug.16
26.oct.16
26-De016
26-Feb.17
26.Apr.17
26.Jun.17
26.Aug.17
26-0&17
26.Dee17
26.FeW18
26.Apr.18
26.Jun.18
26-Ae18
26.oct.18
26.Dee18
26.Feb19
26-Apr-19
26-Jun-19
26.Aue.19

Fig. 1 Popularity trends of data science, machine learning and cybersecurity over time, where x-axis 
represents the timestamp information and y axis represents the corresponding popularity values

Page 3 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 3

Page 3 of 29
Sarker et al. J Big Data            (2020) 7:41

paper does not describe all of the different techniques used in cybersecurity in detail; 
instead, it gives an overview of cybersecurity data science modeling based on artificial 
intelligence, particularly from machine learning perspective.
The ultimate goal of cybersecurity data science is data-driven intelligent decision 
making from security data for smart cybersecurity solutions. CDS represents a partial 
paradigm shift from traditional well-known security solutions such as firewalls, user 
authentication and access control, cryptography systems etc. that might not be effec-
tive according to today’s need in cyber industry [16–19]. The problems are these are 
typically handled statically by a few experienced security analysts, where data man-
agement is done in an ad-hoc manner [20, 21]. However, as an increasing number 
of cybersecurity incidents in different formats mentioned above continuously appear 
over time, such conventional solutions have encountered limitations in mitigat-
ing such cyber risks. As a result, numerous advanced attacks are created and spread 
very quickly throughout the Internet. Although several researchers use various data 
analysis and learning techniques to build cybersecurity models that are summarized 
in “Machine learning tasks in cybersecurity” section, a comprehensive security model 
based on the effective discovery of security insights and latest security patterns could 
be more useful. To address this issue, we need to develop more flexible and efficient 
security mechanisms that can respond to threats and to update security policies to 
mitigate them intelligently in a timely manner. To achieve this goal, it is inherently 
required to analyze a massive amount of relevant cybersecurity data generated from 
various sources such as network and system sources, and to discover insights or 
proper security policies with minimal human intervention in an automated manner.
Analyzing cybersecurity data and building the right tools and processes to success-
fully protect against cybersecurity incidents goes beyond a simple set of functional 
requirements and knowledge about risks, threats or vulnerabilities. For effectively 
extracting the insights or the patterns of security incidents, several machine learning 
techniques, such as feature engineering, data clustering, classification, and associa-
tion analysis, or neural network-based deep learning techniques can be used, which 
are briefly discussed in “Machine learning tasks in cybersecurity” section. These 
learning techniques are capable to find the anomalies or malicious behavior and data-
driven patterns of associated security incidents to make an intelligent decision. Thus, 
based on the concept of data-driven decision making, we aim to focus on cyberse-
curity data science, where the data is being gathered from relevant cybersecurity 
sources such as network activity, database activity, application activity, or user activ-
ity, and the analytics complement the latest data-driven patterns for providing corre-
sponding security solutions.
The contributions of this paper are summarized as follows.

• We first make a brief discussion on the concept of cybersecurity data science and 
relevant methods to understand its applicability towards data-driven intelligent 
decision making in the domain of cybersecurity. For this purpose, we also make a 
review and brief discussion on different machine learning tasks in cybersecurity, 
and summarize various cybersecurity datasets highlighting their usage in different 
data-driven cyber applications.

Page 4 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 4

Page 4 of 29
Sarker et al. J Big Data            (2020) 7:41

• We then discuss and summarize a number of associated research issues and future 
directions in the area of cybersecurity data science, that could help both the aca-
demia and industry people to further research and development in relevant applica-
tion areas.
• Finally, we provide a generic multi-layered framework of the cybersecurity data sci-
ence model based on machine learning techniques. In this framework, we briefly 
discuss how the cybersecurity data science model can be used to discover useful 
insights from security data and making data-driven intelligent decisions to build 
smart cybersecurity systems.

The remainder of the paper is organized as follows. “ Background” section summarizes 
background of our study and gives an overview of the related technologies of cyberse-
curity data science. “ Cybersecurity data science” section defines and discusses briefly 
about cybersecurity data science including various categories of cyber incidents data. 
In “ Machine learning tasks in cybersecurity” section, we briefly discuss various catego-
ries of machine learning techniques including their relations with cybersecurity tasks 
and summarize a number of machine learning based cybersecurity models in the field. 
“Research issues and future directions” section briefly discusses and highlights various 
research issues and future directions in the area of cybersecurity data science. In “ A 
multi-layered framework for smart cybersecurity services” section, we suggest a machine 
learning-based framework to build cybersecurity data science model and discuss various 
layers with their roles. In “ Discussion” section, we highlight several key points regarding 
our studies. Finally,  “Conclusion” section concludes this paper.

Background
In this section, we give an overview of the related technologies of cybersecurity data sci-
ence including various types of cybersecurity incidents and defense strategies.

Cybersecurity
Over the last half-century, the information and communication technology (ICT) indus-
try has evolved greatly, which is ubiquitous and closely integrated with our modern soci-
ety. Thus, protecting ICT systems and applications from cyber-attacks has been greatly 
concerned by the security policymakers in recent days [22]. The act of protecting ICT 
systems from various cyber-threats or attacks has come to be known as cybersecurity 
[9]. Several aspects are associated with cybersecurity: measures to protect informa-
tion and communication technology; the raw data and information it contains and their 
processing and transmitting; associated virtual and physical elements of the systems; 
the degree of protection resulting from the application of those measures; and eventu-
ally the associated field of professional endeavor [23]. Craigen et al. defined “cyberse-
curity as a set of tools, practices, and guidelines that can be used to protect computer 
networks, software programs, and data from attack, damage, or unauthorized access” 
[24]. According to Aftergood et al. [12], “cybersecurity is a set of technologies and pro-
cesses designed to protect computers, networks, programs and data from attacks and 
unauthorized access, alteration, or destruction”. Overall, cybersecurity concerns with the

Page 5 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 5

Page 5 of 29
Sarker et al. J Big Data            (2020) 7:41

understanding of diverse cyber-attacks and devising corresponding defense strategies 
that preserve several properties defined as below [25, 26].

• Confidentiality is a property used to prevent the access and disclosure of informa-
tion to unauthorized individuals, entities or systems.
• Integrity is a property used to prevent any modification or destruction of informa-
tion in an unauthorized manner.
• Availability is a property used to ensure timely and reliable access of information 
assets and systems to an authorized entity.

The term cybersecurity applies in a variety of contexts, from business to mobile 
computing, and can be divided into several common categories. These are - network 
security that mainly focuses on securing a computer network from cyber attackers or 
intruders; application security that takes into account keeping the software and the 
devices free of risks or cyber-threats; information security that mainly considers secu-
rity and the privacy of relevant data; operational security that includes the processes 
of handling and protecting data assets. Typical cybersecurity systems are composed 
of network security systems and computer security systems containing a firewall, 
antivirus software, or an intrusion detection system [27].

Cyberattacks and security risks
The risks typically associated with any attack, which considers three security fac-
tors, such as threats, i.e., who is attacking, vulnerabilities, i.e., the weaknesses they 
are attacking, and impacts, i.e., what the attack does [9]. A security incident is an act 
that threatens the confidentiality, integrity, or availability of information assets and 
systems. Several types of cybersecurity incidents that may result in security risks on 
an organization’s systems and networks or an individual [2]. These are:

• Unauthorized access that describes the act of accessing information to network, sys-
tems or data without authorization that results in a violation of a security policy [2];
• Malware known as malicious software, is any program or software that inten-
tionally designed to cause damage to a computer, client, server, or computer net-
work, e.g., botnets. Examples of different types of malware including computer 
viruses, worms, Trojan horses, adware, ransomware, spyware, malicious bots, etc. 
[3, 26]; Ransom malware, or ransomware, is an emerging form of malware that 
prevents users from accessing their systems or personal files, or the devices, then 
demands an anonymous online payment in order to restore access.
• Denial-of-Service is an attack meant to shut down a machine or network, making 
it inaccessible to its intended users by flooding the target with traffic that triggers 
a crash. The Denial-of-Service (DoS) attack typically uses one computer with an 
Internet connection, while distributed denial-of-service (DDoS) attack uses multi-
ple computers and Internet connections to flood the targeted resource [2];
• Phishing a type of social engineering, used for a broad range of malicious activi-
ties accomplished through human interactions, in which the fraudulent attempt

Page 6 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 6

Page 6 of 29
Sarker et al. J Big Data            (2020) 7:41

takes part to obtain sensitive information such as banking and credit card details, 
login credentials, or personally identifiable information by disguising oneself as a 
trusted individual or entity via an electronic communication such as email, text, 
or instant message, etc. [26];
• Zero-day attack is considered as the term that is used to describe the threat of an 
unknown security vulnerability for which either the patch has not been released 
or the application developers were unaware [4, 28].

Beside these attacks mentioned above, privilege escalation [29], password attack [30], 
insider threat [31], man-in-the-middle [32], advanced persistent threat [33], SQL injec-
tion attack [34], cryptojacking attack [35], web application attack [30] etc. are well-
known as security incidents in the field of cybersecurity. A data breach is another type 
of security incident, known as a data leak, which is involved in the unauthorized access 
of data by an individual, application, or service [5]. Thus, all data breaches are consid-
ered as security incidents, however, all the security incidents are not data breaches. Most 
data breaches occur in the banking industry involving the credit card numbers, personal 
information, followed by the healthcare sector and the public sector [36].

Cybersecurity defense strategies
Defense strategies are needed to protect data or information, information systems, and 
networks from cyber-attacks or intrusions. More granularly, they are responsible for 
preventing data breaches or security incidents and monitoring and reacting to intru-
sions, which can be defined as any kind of unauthorized activity that causes damage to 
an information system [37]. An intrusion detection system (IDS) is typically represented 
as “a device or software application that monitors a computer network or systems for 
malicious activity or policy violations” [38]. The traditional well-known security solu-
tions such as anti-virus, firewalls, user authentication, access control, data encryption 
and cryptography systems, however might not be effective according to today’s need in 
the cyber industry
[16–19]. On the other hand, IDS resolves the issues by analyzing security data from 
several key points in a computer network or system [39, 40]. Moreover, intrusion detec-
tion systems can be used to detect both internal and external attacks.
Intrusion detection systems are different categories according to the usage scope. For 
instance, a host-based intrusion detection system (HIDS), and network intrusion detec-
tion system (NIDS) are the most common types based on the scope of single comput-
ers to large networks. In a HIDS, the system monitors important files on an individual 
system, while it analyzes and monitors network connections for suspicious traffic in a 
NIDS. Similarly, based on methodologies, the signature-based IDS, and anomaly-based 
IDS are the most well-known variants [37].

• Signature-based IDS: A signature can be a predefined string, pattern, or rule that 
corresponds to a known attack. A particular pattern is identified as the detection of 
corresponding attacks in a signature-based IDS. An example of a signature can be 
known patterns or a byte sequence in a network traffic, or sequences used by mal-
ware. To detect the attacks, anti-virus software uses such types of sequences or pat-

Page 7 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 7

Page 7 of 29
Sarker et al. J Big Data            (2020) 7:41

terns as a signature while performing the matching operation. Signature-based IDS 
is also known as knowledge-based or misuse detection [41]. This technique can be 
efficient to process a high volume of network traffic, however, is strictly limited to the 
known attacks only. Thus, detecting new attacks or unseen attacks is one of the big-
gest challenges faced by this signature-based system.
• Anomaly-based IDS: The concept of anomaly-based detection overcomes the issues 
of signature-based IDS discussed above. In an anomaly-based intrusion detection 
system, the behavior of the network is first examined to find dynamic patterns, to 
automatically create a data-driven model, to profile the normal behavior, and thus it 
detects deviations in the case of any anomalies [41]. Thus, anomaly-based IDS can 
be treated as a dynamic approach, which follows behavior-oriented detection. The 
main advantage of anomaly-based IDS is the ability to identify unknown or zero-day 
attacks [42]. However, the issue is that the identified anomaly or abnormal behavior 
is not always an indicator of intrusions. It sometimes may happen because of several 
factors such as policy changes or offering a new service.

In addition, a hybrid detection approach [43, 44] that takes into account both the mis-
use and anomaly-based techniques discussed above can be used to detect intrusions. 
In a hybrid system, the misuse detection system is used for detecting known types of 
intrusions and anomaly detection system is used for novel attacks [45]. Beside these 
approaches, stateful protocol analysis can also be used to detect intrusions that identi-
fies deviations of protocol state similarly to the anomaly-based method, however it uses 
predetermined universal profiles based on accepted definitions of benign activity [41]. 
In Table 1, we have summarized these common approaches highlighting their pros and 
cons. Once the detecting has been completed, the intrusion prevention system (IPS) that 
is intended to prevent malicious events, can be used to mitigate the risks in different 
ways such as manual, providing notification, or automatic process [46]. Among these 
approaches, an automatic response system could be more effective as it does not involve 
a human interface between the detection and response systems.

Data science
We are living in the age of data, advanced analytics, and data science, which are related 
to data-driven intelligent decision making. Although, the process of searching patterns 
or discovering hidden and interesting knowledge from data is known as data mining

Table 1 Various types of intrusion detection approaches

Signature-based IDS
Simplest and effective method to detect 
known attacks
Ineffective to detect unknown attacks

Anomaly-based IDS
Effective to detect new and unforeseen 
vulnerabilities
Anomaly is not always an indicator of intru-
sions, and may increase false positive rate

Hybrid approach
Reduce the false positive rate of unknown 
attacks
Model might be complex

Stateful protocol 
analysis approach
Know and trace the protocol states
Unable to inspect attacks looking like benign 
protocol behaviors

Page 8 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 8

Page 8 of 29
Sarker et al. J Big Data            (2020) 7:41

[47], in this paper, we use the broader term “data science” rather than data mining. The 
reason is that, data science, in its most fundamental form, is all about understanding 
of data. It involves studying, processing, and extracting valuable insights from a set of 
information. In addition to data mining, data analytics is also related to data science. 
The development of data mining, knowledge discovery, and machine learning that refers 
creating algorithms and program which learn on their own, together with the original 
data analysis and descriptive analytics from the statistical perspective, forms the gen-
eral concept of “data analytics” [47]. Nowadays, many researchers use the term “data sci-
ence” to describe the interdisciplinary field of data collection, preprocessing, inferring, 
or making decisions by analyzing the data. To understand and analyze the actual phe-
nomena with data, various scientific methods, machine learning techniques, processes, 
and systems are used, which is commonly known as data science. According to Cao et al. 
[47] “data science is a new interdisciplinary field that synthesizes and builds on statis-
tics, informatics, computing, communication, management, and sociology to study data 
and its environments, to transform data to insights and decisions by following a data-
to-knowledge-to-wisdom thinking and methodology”. As a high-level statement in the 
context of cybersecurity, we can conclude that it is the study of security data to provide 
data-driven solutions for the given security problems, as known as “the science of cyber-
security data”. Figure 2 shows the typical data-to-insight-to-decision transfer at different 
periods and general analytic stages in data science, in terms of a variety of analytics goals 
(G) and approaches (A) to achieve the data-to-decision goal [47].
Based on the analytic power of data science including machine learning techniques, it 
can be a viable component of security strategies. By using data science techniques, secu-
rity analysts can manipulate and analyze security data more effectively and efficiently, 
uncovering valuable insights from data. Thus, data science methodologies including 
machine learning techniques can be well utilized in the context of cybersecurity, in 
terms of problem understanding, gathering security data from diverse sources, prepar-
ing data to feed into the model, data-driven model building and updating, for provid-
ing smart security services, which motivates to define cybersecurity data science and to 
work in this research area.

Cybersecurity data science
In this section, we briefly discuss cybersecurity data science including various categories 
of cyber incidents data with the usage in different application areas, and the key terms 
and areas related to our study.

Fig. 2 Data-to-insight-to-decision analytic stages in data science [47]

Page 9 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 9

Page 9 of 29
Sarker et al. J Big Data            (2020) 7:41

Understanding cybersecurity data
Data science is largely driven by the availability of data [48]. Datasets typically repre-
sent a collection of information records that consist of several attributes or features 
and related facts, in which cybersecurity data science is based on. Thus, it’s important 
to understand the nature of cybersecurity data containing various types of cyberattacks 
and relevant features. The reason is that raw security data collected from relevant cyber 
sources can be used to analyze the various patterns of security incidents or malicious 
behavior, to build a data-driven security model to achieve our goal. Several datasets 
exist in the area of cybersecurity including intrusion analysis, malware analysis, anom-
aly, fraud, or spam analysis that are used for various purposes. In Table 2, we summarize 
several such datasets including their various features and attacks that are accessible on 
the Internet, and highlight their usage based on machine learning techniques in different 
cyber applications. Effectively analyzing and processing of these security features, build-
ing target machine learning-based security model according to the requirements, and 
eventually, data-driven decision making, could play a role to provide intelligent cyberse-
curity services that are discussed briefly in “A multi-layered framework for smart cyber-
security services” section.

Defining cybersecurity data science
Data science is transforming the world’s industries. It is critically important for the 
future of intelligent cybersecurity systems and services because of “security is all about 
data”. When we seek to detect cyber threats, we are analyzing the security data in the 
form of files, logs, network packets, or other relevant sources. Traditionally, security 
professionals didn’t use data science techniques to make detections based on these data 
sources. Instead, they used file hashes, custom-written rules like signatures, or manu-
ally defined heuristics [21]. Although these techniques have their own merits in sev-
eral cases, it needs too much manual work to keep up with the changing cyber threat 
landscape. On the contrary, data science can make a massive shift in technology and its 
operations, where machine learning algorithms can be used to learn or extract insight of 
security incident patterns from the training data for their detection and prevention. For 
instance, to detect malware or suspicious trends, or to extract policy rules, these tech-
niques can be used.
In recent days, the entire security industry is moving towards data science, because of 
its capability to transform raw data into decision making. To do this, several data-driven 
tasks can be associated, such as—(i) data engineering focusing practical applications of 
data gathering and analysis; (ii) reducing data volume that deals with filtering signifi-
cant and relevant data to further analysis; (iii) discovery and detection that focuses on 
extracting insight or incident patterns or knowledge from data; (iv) automated models 
that focus on building data-driven intelligent security model; (v) targeted security  alerts 
focusing on the generation of remarkable security alerts based on discovered knowledge 
that minimizes the false alerts, and (vi) resource optimization that deals with the avail-
able resources to achieve the target goals in a security system. While making data-driven 
decisions, behavioral analysis could also play a significant role in the domain of cyberse-
curity [81].

Page 10 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 10

Page 10 of 29
Sarker et al. J Big Data            (2020) 7:41

Table 2 A summary of  cybersecurity datasets highlighting diverse attack-types 
and machine learning-based usage in different cyber applications

DARPA
Intrusion detection dataset that includes LLDOS 1.0 and LLDOS 2.0.2 attack scenario 
data. Data traffic and attacks containing in DARPA are collected by MIT Lincoln 
Laboratory for evaluating network intrusion detection systems [44, 49]

KDD’99 Cup
Most widely used data set containing 41 features for evaluating anomaly detection 
methods, where attacks are categorized into four major classes, such as denial of 
service (DoS), remote-to-local (R2L), user-to-remote (U2R), and probing [50]. KDD’99 
Cup dataset can be used to evaluate ML-based attack detection model

NSL-KDD
A refined version of KDD’99 cup dataset where redundant records are eliminated. 
Thus ML classification based security model utilizing NSL-KDD dataset will not be 
biased towards more frequent records [51]

CAIDA
The datasets CAIDA’07 and CAIDA’08 contain DDoS attack traffic and normal traffic 
traces [52, 53]. Thus CAIDA DDoS dataset can be used to evaluate ML-based DDoS 
attack detection model and inferring Internet Denial-of-Service activity

ISOT’10
A combination of malicious and non-malicious type of data traffic created by Infor-
mation Security and Object Technology (ISOT) research at University of Victoria [54, 
55]. To evaluate ML-based classification models ISOT datasets can be used

ISCX’12
The dataset contains 19 features and 19.11% of the traffic belongs to DDoS attacks. 
ISCX’12 was produced at the Canadian Institute for Cybersecurity [56, 57] and can 
be used to evaluate the effectiveness of ML-based network intrusion detection 
modeling

CTU-13
A labeled malware dataset including botnet, normal, and background traffic that 
was captured at CTU University, Czech Republic [58]. CTU-13 can be used for 
data-driven malware analysis using ML techniques and to evaluate the malware 
detection system

UNSW-NB15
The dataset has 49 features and nine different types of attacks including DoS that was 
created at the University of New South Wales in 2015 [59]. UNSW-NB15 can be used 
for evaluating ML-based anomaly detection system in cyber applications.

CIC-IDS2018 CIC-IDS2017
The datasets include different attack scenarios, namely Brute-force, Heartbleed, 
Botnet, HTTP DoS, DDoS, Web attacks, and insider attack, collected by the Canadian 
Institute for Cybersecurity [60]. Datasets can be used for evaluating ML based intru-
sion detection systems including Zero-Day attacks

CIC-DDoS2019
A dataset containing DDoS attacks was collected by the Canadian Institute for 
Cybersecurity [61]. CIC-DDoS can be used for network traffic behavioral analytics to 
detect DDoS attacks using ML techniques

MAWI
A collection of Japanese network research institutions and academic institutions used 
to detect and evaluate DDoS intrusions using ML techniques [62]

ADFA IDS
An intrusion dataset with different versions named ADFA-LD and ADFA-WD issued by 
the Australian Defence Academy (ADFA) [63]. They are designed for evaluation by 
host-based IDS

CERT
The dataset includes users’ activity logs that was created for the purpose of validating 
insider-threat detection systems [64, 65]. This can be used to analyze ML based user 
behavioral activities

Email
Email datasets are difficult to obtain because of privacy concerns. Some common cor-
pora of emails include EnronSpam [66], SpamAssassin [67], and LingSpam [68]

DGA
The Alexa Top Sites dataset is generally used as a source of benign domain names 
[69]. The malicious domain names are obtained from OSINT [70] and DGArchive 
[71]. DGA dataset can be used for experiments in ML-based automatic DGA 
domains classification or botnet detection [72]

Malware
Several malware datasets such as Genome project [73], Virus Share [74], VirusTotal [75], 
Comodo [76], Contagio [77], DREBIN [78], and Microsoft [79] contain malicious files. 
These datasets can be used for data-driven malware analysis using ML techniques 
and to evaluate malware detection system

Bot-IoT
A dataset that incorporates legitimate and simulated IoT network traffic, along with 
different attacks for network forensic analytics in the area of Internet of Things [80]. 
Bot-IoT can be used to evaluate the reliability using different statistical and machine 
learning methods for forensics purposes

Page 11 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 11

Page 11 of 29
Sarker et al. J Big Data            (2020) 7:41

Thus, the concept of cybersecurity data science incorporates the methods and tech-
niques of data science and machine learning as well as the behavioral analytics of var-
ious security incidents. The combination of these technologies has given birth to the 
term “cybersecurity data science”, which refers to collect a large amount of security 
event data from different sources and analyze it using machine learning technologies 
for detecting security risks or attacks either through the discovery of useful insights 
or the latest data-driven patterns. It is, however, worth remembering that cybersecu-
rity data science is not just about a collection of machine learning algorithms, rather,  
a process that can help security professionals or analysts to scale and automate their 
security activities in a smart way and in a timely manner. Therefore, the formal defi-
nition can be as follows: “Cybersecurity data science is  a research or working area 
existing at the intersection of cybersecurity, data science, and machine learning or 
artificial intelligence, which is mainly security data-focused, applies machine learn-
ing methods, attempts to quantify cyber-risks or incidents, and promotes infer-
ential techniques to analyze behavioral patterns in security data. It also focuses on

Table 3 A summary of key terms and areas related to cybersecurity data science

Security incident or attack
An incident or cyber-attack, is any act that threatens the security, confidentiality, 
integrity, or availability of information assets, information systems, or the networks 
that deliver the information

Data breach
An intentional or unintentional release of secure data to an untrusted environment, 
which is also known as data spill or data leak

Cyber anomaly
Anomalies are data points, items, observations or events that do not conform to the 
expected pattern of a given group, such as cyber intrusions or fraud. Anomalies 
are also referred to as outliers, noise, deviations, and exceptions in cyber data

Cybercrime
A criminal activity done using computers and the Internet, that can be committed 
against government and private organizations

Cybersecurity
A set of technologies and processes designed to protect networks, devices, pro-
grams, and data from various cyber attacks, damages, or unauthorized access

Data science
Focuses on the collection and application of data to provide insights or meaningful 
information in industry, academia, or the context of human life

Artificial intelligence (AI)
A technology that behaves intelligently with the ability of thinking and working like 
humans, e.g., intelligent decision making in cyber domain

Machine learning
A significant part of AI, which deals with the scientific study of algorithms and statis-
tical models that learn from cybersecurity data to perform a specific task without 
using explicit instructions, relying on security incident patterns and inference 
instead.

Deep learning
A significant part of machine learning in AI that typically builds security models 
based on artificial neural networks consisting of several data processing layers

Cyber features
These are attributes, extracted from cyber data sources to analyze and build target 
cyber security models

Security models
Models take features as inputs and they apply simple or hybrid machine learning 
algorithms to come up with a specific outcome for a cybersecurity use case for 
intelligent decision making

Threat intelligence
Deals with gathering raw data of threats, and then analyzes and filters the data to 
produce usable information for automated security control systems, i.e., evidence-
based knowledge in cybersecurity

Behavioral analytics
Deals with the behavioral patterns of various security incidents or the malicious 
behavior in the data

Internet-of-Things (IoT)
A smart environment where an object that can represent itself becomes greater by 
connecting to surrounding objects and the extensive data flowing around it, in 
which the cyber criminals are associated with.

Page 12 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 12

Page 12 of 29
Sarker et al. J Big Data            (2020) 7:41

generating security response alerts, and eventually seeks for optimizing cybersecurity 
solutions, to build automated and intelligent cybersecurity systems.”
Table  3 highlights some key terms associated with cybersecurity data science. 
Overall, the outputs of cybersecurity data science are typically security data prod-
ucts, which can be a data-driven security model, policy rule discovery, risk or attack 
prediction, potential security service and recommendation, or the corresponding 
security system depending on the given security problem in the domain of cybersecu-
rity. In the next section, we briefly discuss various machine learning tasks with exam-
ples within the scope of our study.

Machine learning tasks in cybersecurity
Machine learning (ML) is typically considered as a branch of “Artificial Intelligence”, 
which is closely related to computational statistics, data mining and analytics, data sci-
ence, particularly focusing on making the computers to learn from data [82, 83]. Thus, 
machine learning models typically comprise of a set of rules, methods, or complex 
“transfer functions” that can be applied to find interesting data patterns, or to recognize 
or predict behavior [84], which could play an important role in the area of cybersecurity. 
In the following, we discuss different methods that can be used to solve machine learn-
ing tasks and how they are related to cybersecurity tasks.

Supervised learning
Supervised learning is performed when specific targets are defined to reach from a cer-
tain set of inputs, i.e., task-driven approach. In the area of machine learning, the most 
popular supervised learning techniques are known as classification and regression meth-
ods [129]. These techniques are popular to classify or predict the future for a particular 
security problem. For instance, to predict denial-of-service attack (yes, no) or to identify 
different classes of network attacks such as scanning and spoofing, classification tech-
niques can be used in the cybersecurity domain. ZeroR [83], OneR [130], Navies Bayes 
[131], Decision Tree [132, 133], K-nearest neighbors [134], support vector machines 
[135], adaptive boosting [136], and logistic regression [137] are the well-known classifi-
cation techniques. In addition, recently Sarker et al. have proposed BehavDT [133], and 
IntruDtree [106] classification techniques that are able to effectively build a data-driven 
predictive model. On the other hand, to predict the continuous or numeric value, e.g., 
total phishing attacks in a certain period or predicting the network packet parameters, 
regression techniques are useful. Regression analyses can also be used to detect the root 
causes of cybercrime and other types of fraud [138]. Linear regression [82], support vec-
tor regression [135] are the popular regression techniques. The main difference between 
classification and regression is that the output variable in the regression is numerical 
or continuous, while the predicted output for classification is categorical or discrete. 
Ensemble learning is an extension of supervised learning while mixing different sim-
ple models, e.g., Random Forest learning [139] that generates multiple decision trees to 
solve a particular security task.

Page 13 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 13

Page 13 of 29
Sarker et al. J Big Data            (2020) 7:41

Unsupervised learning
In unsupervised learning problems, the main task is to find patterns, structures, or 
knowledge in unlabeled data, i.e., data-driven approach [140]. In the area of cyberse-
curity, cyber-attacks like malware stays hidden in some ways, include changing their 
behavior dynamically and autonomously to avoid detection. Clustering techniques, a 
type of unsupervised learning, can help to uncover the hidden patterns and structures 
from the datasets, to identify indicators of such sophisticated attacks. Similarly, in iden-
tifying anomalies, policy violations, detecting, and eliminating noisy instances in data, 
clustering techniques can be useful. K-means [141], K-medoids [142] are the popular 
partitioning clustering algorithms, and single linkage [143] or complete linkage [144] are 
the well-known hierarchical clustering algorithms used in various application domains. 
Moreover, a bottom-up clustering approach proposed by Sarker et al. [145] can also be 
used by taking into account the data characteristics.
Besides, feature engineering tasks like optimal feature selection or extraction related 
to a particular security problem could be useful for further analysis [106]. Recently, 
Sarker et al. [106] have proposed an approach for selecting security features according 
to their importance score values. Moreover, Principal component analysis, linear discri-
minant analysis, pearson correlation analysis, or non-negative matrix factorization are 
the popular dimensionality reduction techniques to solve such issues [82]. Association 
rule learning is another example, where machine learning based policy rules can prevent 
cyber-attacks. In an expert system, the rules are usually manually defined by a knowl-
edge engineer working in collaboration with a domain expert [37, 140, 146]. Association 
rule learning on the contrary, is the discovery of rules or relationships among a set of 
available security features or attributes in a given dataset [147]. To quantify the strength 
of relationships, correlation analysis can be used [138]. Many association rule mining 
algorithms have been proposed in the area of machine learning and data mining litera-
ture, such as logic-based [148], frequent pattern based [149–151], tree-based [152], etc. 
Recently, Sarker et al. [153] have proposed an association rule learning approach con-
sidering non-redundant generation, that can be used to discover a set of useful security 
policy rules. Moreover, AIS [147], Apriori [149], Apriori-TID and Apriori-Hybrid [149], 
FP-Tree [152], and RARM [154], and Eclat [155] are the well-known association rule 
learning algorithms that are capable to solve such problems by generating a set of policy 
rules in the domain of cybersecurity.

Neural networks and deep learning
Deep learning is a part of machine learning in the area of artificial intelligence, which is 
a computational model that is inspired by the biological neural networks in the human 
brain [82]. Artificial Neural Network (ANN) is frequently used in deep learning and the 
most popular neural network algorithm is backpropagation [82]. It performs learning 
on a multi-layer feed-forward neural network consists of an input layer, one or more 
hidden layers, and an output layer. The main difference between deep learning and clas-
sical machine learning is its performance on the amount of security data increases. Typi-
cally deep learning algorithms perform well when the data volumes are large, whereas 
machine learning algorithms perform comparatively better on small datasets [44]. In our 
earlier work, Sarker et al. [129], we have illustrated the effectiveness of these approaches

Page 14 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 14

Page 14 of 29
Sarker et al. J Big Data            (2020) 7:41

considering contextual datasets. However, deep learning approaches mimic the human 
brain mechanism to interpret large amount of data or the complex data such as images, 
sounds and texts [44, 129]. In terms of feature extraction to build models, deep learning 
reduces the effort of designing a feature extractor for each problem than the classical 
machine learning techniques. Beside these characteristics, deep learning typically takes 
a long time to train an algorithm than a machine learning algorithm, however, the test 
time is exactly the opposite [44]. Thus, deep learning relies more on high-performance 
machines with GPUs than classical machine-learning algorithms [44, 156]. The most 
popular deep neural network learning models include multi-layer perceptron (MLP) 
[157], convolutional neural network (CNN) [158], recurrent neural network (RNN) or 
long-short term memory (LSTM) network [121, 158]. In recent days, researchers use 
these deep learning techniques for different purposes such as detecting network intru-
sions, malware traffic detection and classification, etc. in the domain of cybersecurity 
[44, 159].

Other learning techniques
Semi-supervised learning can be described as a hybridization of supervised and unsu-
pervised techniques discussed above, as it works on both the labeled and unlabeled data. 
In the area of cybersecurity, it could be useful, when it requires to label data automati-
cally without human intervention, to improve the performance of cybersecurity mod-
els. Reinforcement techniques are another type of machine learning that characterizes 
an agent by creating its own learning experiences through interacting directly with the 
environment, i.e., environment-driven approach, where the environment is typically 
formulated as a Markov decision process and take decision based on a reward function 
[160]. Monte Carlo learning, Q-learning, Deep Q Networks, are the most common rein-
forcement learning algorithms [161]. For instance, in a recent work [126], the authors 
present an approach for detecting botnet traffic or malicious cyber activities using rein-
forcement learning combining with neural network classifier. In another work [128], 
the authors discuss about the application of deep reinforcement learning to intrusion 
detection for supervised problems, where they received the best results for the Deep 
Q-Network algorithm. In the context of cybersecurity, genetic algorithms that use fit-
ness, selection, crossover, and mutation for finding optimization, could also be used to 
solve a similar class of learning problems [119].
Various types of machine learning techniques discussed above can be useful in the 
domain of cybersecurity, to build an effective security model. In Table 4, we have sum-
marized several machine learning techniques that are used to build various types of 
security models for various purposes. Although these models typically represent a learn-
ing-based security model, in this paper, we aim to focus on a comprehensive cyberse-
curity data science model and relevant issues, in order to build a data-driven intelligent 
security system. In the next section, we highlight several research issues and potential 
solutions in the area of cybersecurity data science.

Page 15 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 15

Page 15 of 29
Sarker et al. J Big Data            (2020) 7:41

Table 4 A summary of machine learning tasks in the domain of cybersecurity

SVM
To classify various attacks such as 
DoS, Probe, U2R, and R2L
Kotpalliwar et al. [85]

SVM
Feature selection, intrusion detec-
tion and classification
Pervez et al. [86], Yan et al. [87], Li 
et al. [88], Raman et al. [89]

SVM
DDoS detection and analysis in 
SDN-based environment
Kokila et al. [90]

SVM
Evaluating host-based anomaly 
detection systems
Xie et al. [91]

SVM-PSO
To build intrusion detection system
Saxena et al. [92]

FCM clustering, ANN and SVM
To build network intrusion detec-
tion system
Chandrasekhar et al. [93]

KNN
Network intrusion detection system
Shapoorifard et al. [94], Vishwakarma 
et al. [95]

KNN
To reduce the false alarm rate
Meng et al. [96]

SVM and KNN
To build intrusion detection system
Dada et al. [97]

K-means and KNN
To build intrusion detection system
Sharifi et al. [98]

KNN and Clustering
To build intrusion detection system
Lin et al. [99]

Naive Bayes
To build an intrusion detection sys-
tem for multi-class classification.
Koc et al. [100]

Decision Tree
To detect the malicious code’s 
behavior information by run-
ning malicious code on the 
virtual machine and analyze the 
behavior information for intrusion 
detection.

Decision Tree
Feature selection and to build an 
effective network intrusion detec-
tion system

Ingre et al. [102], Malik et al. [103], 
Relan et al. [104], Rai et al. [105], 
Sarker et al. [106], Puthran et al. 
[107]

Decision Tree and KNN
Anomaly intrusion detection 
system
Balogun et al. [108]

Genetic Algorithm and Decision 
Tree
To solve the problem of small dis-
junct in the decision tree based 
intrusion detection system

Decision Tree and ANN
To measure the performance of 
intrusion detection system
Jo et al. [110]

Random Forests
To build network intrusion detec-
tion systems
Zhang et al. [111]

Association Rule
To build network intrusion detec-
tion systems
Tajbakhsh et al. [112]

Behavior Rule
To build intrusion detection system 
for safety critical medical cyber 
physical systems

Supervised
For malware detection and analysis
Alazab et al. [114], Alazab et al. [4]

Semi-supervised Adaboost
For network anomaly detection
Yuan et al. [115]

Hidden Markov Models
To build an intrusion detection 
system
Ariu et al. [116], Aarnes et al. [117]

Genetic Algorithm
For prevention of cyberterrorism 
through dynamic and evolving 
intrusion detection

Deep Learning Recurrent, RNN, 
LSTM
To build anomaly intrusion detec-
tion system and attack classifica-
tion

Alrawashdeh et al. [120], Yin et al. 
[121], Kim et al. [122], Almiani et al. 
[123]

Deep Learning Convolutional
Malware traffic classification system
Kolosnjaji et al. [124], Wang et al. 
[125]

Deep and Reinforcement Learning
Malicious activities and intrusion 
detection system
Alauthman et al. [126], Blanco et al. 
[127], Lopez et al. [128]

Page 16 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 16

Page 16 of 29
Sarker et al. J Big Data            (2020) 7:41

Research issues and future directions
Our study opens several research issues and challenges in the area of cybersecurity data 
science to extract insight from relevant data towards data-driven intelligent decision 
making for cybersecurity solutions. In the following, we summarize these challenges 
ranging from data collection to decision making.

• Cybersecurity datasets: Source datasets are the primary component to work in the 
area of cybersecurity data science. Most of the existing datasets are old and might 
insufficient in terms of understanding the recent behavioral patterns of various 
cyber-attacks. Although the data can be transformed into a meaningful understand-
ing level after performing several processing tasks, there is still a lack of understand-
ing of the characteristics of recent attacks and their patterns of happening. Thus, fur-
ther processing or machine learning algorithms may provide a low accuracy rate for 
making the target decisions. Therefore, establishing a large number of recent datasets 
for a particular problem domain like cyber risk prediction or intrusion detection is 
needed, which could be one of the major challenges in cybersecurity data science.
• Handling quality problems in cybersecurity datasets: The cyber datasets might be 
noisy, incomplete, insignificant, imbalanced, or may contain inconsistency instances 
related to a particular security incident. Such problems in a data set may affect the 
quality of the learning process and degrade the performance of the machine learn-
ing-based models [162]. To make a data-driven intelligent decision for cybersecu-
rity solutions, such problems in data is needed to deal effectively before building the 
cyber models. Therefore, understanding such problems in cyber data and effectively 
handling such problems using existing algorithms or newly proposed algorithm for a 
particular problem domain like malware analysis or intrusion detection and preven-
tion is needed, which could be another research issue in cybersecurity data science.
• Security policy rule generation: Security policy rules reference security zones and 
enable a user to allow, restrict, and track traffic on the network based on the corre-
sponding user or user group, and service, or the application. The policy rules includ-
ing the general and more specific rules are compared against the incoming traffic 
in sequence during the execution, and the rule that matches the traffic is applied. 
The policy rules used in most of the cybersecurity systems are static and generated 
by human expertise or ontology-based [163, 164]. Although, association rule learn-
ing techniques produce rules from data, however, there is a problem of redundancy 
generation [153] that makes the policy rule-set complex. Therefore, understanding 
such problems in policy rule generation and effectively handling such problems using 
existing algorithms or newly proposed algorithm for a particular problem domain 
like access control [165] is needed, which could be another research issue in cyberse-
curity data science.
• Hybrid learning method: Most commercial products in the cybersecurity domain 
contain signature-based intrusion detection techniques [41]. However, missing fea-
tures or insufficient profiling can cause these techniques to miss unknown attacks. 
In that case, anomaly-based detection techniques or hybrid technique combining 
signature-based and anomaly-based can be used to overcome such issues. A hybrid 
technique combining multiple learning techniques or a combination of deep learning

Page 17 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 17

Page 17 of 29
Sarker et al. J Big Data            (2020) 7:41

and machine-learning methods can be used to extract the target insight for a particu-
lar problem domain like intrusion detection, malware analysis, access control, etc. 
and make the intelligent decision for corresponding cybersecurity solutions.
• Protecting the valuable security information: Another issue of a cyber data attack is 
the loss of extremely valuable data and information, which could be damaging for 
an organization. With the use of encryption or highly complex signatures, one can 
stop others from probing into a dataset. In such cases, cybersecurity data science 
can be used to build a data-driven impenetrable protocol to protect such security 
information. To achieve this goal, cyber analysts can develop algorithms by analyz-
ing the history of cyberattacks to detect the most frequently targeted chunks of data. 
Thus, understanding such data protecting problems and designing corresponding 
algorithms to effectively handling these problems, could be another research issue in 
the area of cybersecurity data science.
• Context-awareness in cybersecurity: Existing cybersecurity work mainly originates 
from the relevant cyber data containing several low-level features. When data min-
ing and machine learning techniques are applied to such datasets, a related pattern 
can be identified that describes it properly. However, a broader contextual informa-
tion [140, 145, 166] like temporal, spatial, relationship among events or connections, 
dependency can be used to decide whether there exists a suspicious activity or not. 
For instance, some approaches may consider individual connections as DoS attacks, 
while security experts might not treat them as malicious by themselves. Thus, a sig-
nificant limitation of existing cybersecurity work is the lack of using the contextual 
information for predicting risks or attacks. Therefore, context-aware adaptive cyber-
security solutions could be another research issue in cybersecurity data science.
• Feature engineering in cybersecurity: The efficiency and effectiveness of a machine 
learning-based security model has always been a major challenge due to the high vol-
ume of network data with a large number of traffic features. The large dimensionality 
of data has been addressed using several techniques such as principal component 
analysis (PCA) [167], singular value decomposition (SVD) [168] etc. In addition to 
low-level features in the datasets, the contextual relationships between suspicious 
activities might be relevant. Such contextual data can be stored in an ontology or tax-
onomy for further processing. Thus how to effectively select the optimal features or 
extract the significant features considering both the low-level features as well as the 
contextual features, for effective cybersecurity solutions could be another research 
issue in cybersecurity data science.
• Remarkable security alert generation and prioritizing: In many cases, the cyberse-
curity system may not be well defined and may cause a substantial number of false 
alarms that are unexpected in an intelligent system. For instance, an IDS deployed in 
a real-world network generates around nine million alerts per day [169]. A network-
based intrusion detection system typically looks at the incoming traffic for matching 
the associated patterns to detect risks, threats or vulnerabilities and generate security 
alerts. However, to respond to each such alert might not be effective as it consumes 
relatively huge amounts of time and resources, and consequently may result in a self-
inflicted DoS. To overcome this problem, a high-level management is required that 
correlate the security alerts considering the current context and their logical rela-

Page 18 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 18

Page 18 of 29
Sarker et al. J Big Data            (2020) 7:41

tionship including their prioritization before reporting them to users, which could be 
another research issue in cybersecurity data science.
• Recency analysis in cybersecurity solutions: Machine learning-based security models 
typically use a large amount of static data to generate data-driven decisions. Anomaly 
detection systems rely on constructing such a model considering normal behavior 
and anomaly, according to their patterns. However, normal behavior in a large and 
dynamic security system is not well defined and it may change over time, which can 
be considered as an incremental growing of dataset. The patterns in incremental 
datasets might be changed in several cases. This often results in a substantial num-
ber of false alarms known as false positives. Thus, a recent malicious behavioral pat-
tern is more likely to be interesting and significant than older ones for predicting 
unknown attacks. Therefore, effectively using the concept of recency analysis [170] in 
cybersecurity solutions could be another issue in cybersecurity data science.

The most important work for an intelligent cybersecurity system is to develop an effec-
tive framework that supports data-driven decision making. In such a framework, we 
need to consider advanced data analysis based on machine learning techniques, so that 
the framework is capable to minimize these issues and to provide automated and intel-
ligent security services. Thus, a well-designed security framework for cybersecurity data 
and the experimental evaluation is a very important direction and a big challenge as well. 
In the next section, we suggest and discuss a data-driven cybersecurity framework based 
on machine learning techniques considering multiple processing layers.

Smart Cybersecurity Systems and Services
(Automated and Intelligent)
Incremental Learning and Dynamism
Recency Mining and
Post-processing and
Respcmse Planning
Making
Machine Leaming based Security Modeling
Security Feature
Engineering
Or Malicious
Behavior Detection
Creating Similar Incident
Groups or Data Clustering
Association Learning and
Policy Rule
Data preparing
Attack ClassificatOn Or
Prediction
Mcxiel Selection or
Customization
[Data Cleansing, Normalization, Transtorrnation, Collation etc.l
Structured Data
Semi-structured Data
Security Data Collecting
Unstructured Data
[Network activity , Database activity , activity
Data I Data Source 2
Cyber Infrastructure
Data Source N

Fig. 3 A generic multi-layered framework based on machine learning techniques for smart cybersecurity 
services

Page 19 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 19

Page 19 of 29
Sarker et al. J Big Data            (2020) 7:41

A multi-layered framework for smart cybersecurity services
As discussed earlier, cybersecurity data science is data-focused, applies machine learn-
ing methods, attempts to quantify cyber risks, promotes inferential techniques to ana-
lyze behavioral patterns, focuses on generating security response alerts, and eventually 
seeks for optimizing cybersecurity operations. Hence, we briefly discuss a multiple data 
processing layered framework that potentially can be used to discover security insights 
from the raw data to build smart cybersecurity systems, e.g., dynamic policy rule-based 
access control or intrusion detection and prevention system. To make a data-driven 
intelligent decision in the resultant cybersecurity system, understanding the security 
problems and the nature of corresponding security data and their vast analysis is needed. 
For this purpose, our suggested framework not only considers the machine learning 
techniques to build the security model but also takes into account the incremental learn-
ing and dynamism to keep the model up-to-date and corresponding response genera-
tion, which could be more effective and intelligent for providing the expected services. 
Figure 3 shows an overview of the framework, involving several processing layers, from 
raw security event data to services. In the following, we briefly discuss the working pro-
cedure of the framework.

Security data collecting
Collecting valuable cybersecurity data is a crucial step, which forms a connecting link 
between security problems in cyberinfrastructure and corresponding data-driven solu-
tion steps in this framework, shown in Fig. 3. The reason is that cyber data can serve as 
the source for setting up ground truth of the security model that affect the model perfor-
mance. The quality and quantity of cyber data decide the feasibility and effectiveness of 
solving the security problem according to our goal. Thus, the concern is how to collect 
valuable and unique needs data for building the data-driven security models.
The general step to collect and manage security data from diverse data sources is 
based on a particular security problem and project within the enterprise. Data sources 
can be classified into several broad categories such as network, host, and hybrid [171]. 
Within the network infrastructure, the security system can leverage different types of 
security data such as IDS logs, firewall logs, network traffic data, packet data, and hon-
eypot data, etc. for providing the target security services. For instance, a given IP is con-
sidered malicious or not, could be detected by performing data analysis utilizing the data 
of IP addresses and their cyber activities. In the domain of cybersecurity, the network 
source mentioned above is considered as the primary security event source to analyze. 
In the host category, it collects data from an organization’s host machines, where the 
data sources can be operating system logs, database access logs, web server logs, email 
logs, application logs, etc. Collecting data from both the network and host machines 
are considered a hybrid category. Overall, in a data collection layer the network activity, 
database activity, application activity, and user activity can be the possible security event 
sources in the context of cybersecurity data science.

Security data preparing
After collecting the raw security data from various sources according to the problem 
domain discussed above, this layer is responsible to prepare the raw data for building the

Page 20 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 20

Page 20 of 29
Sarker et al. J Big Data            (2020) 7:41

model by applying various necessary processes. However, not all of the collected data 
contributes to the model building process in the domain of cybersecurity [172]. There-
fore, the useless data should be removed from the rest of the data captured by the net-
work sniffer. Moreover, data might be noisy, have missing or corrupted values, or have 
attributes of widely varying types and scales. High quality of data is necessary for achiev-
ing higher accuracy in a data-driven model, which is a process of learning a function that 
maps an input to an output based on example input-output pairs. Thus, it might require 
a procedure for data cleaning, handling missing or corrupted values. Moreover, security 
data features or attributes can be in different types, such as continuous, discrete, or sym-
bolic [106]. Beyond a solid understanding of these types of data and attributes and their 
permissible operations, its need to preprocess the data and attributes to convert into 
the target type. Besides, the raw data can be in different types such as structured, semi-
structured, or unstructured, etc. Thus, normalization, transformation, or collation can 
be useful to organize the data in a structured manner. In some cases, natural language 
processing techniques might be useful depending on data type and characteristics, e.g., 
textual contents. As both the quality and quantity of data decide the feasibility of solving 
the security problem, effectively pre-processing and management of data and their rep-
resentation can play a significant role to build an effective security model for intelligent 
services.

Machine learning‑based security modeling
This is the core step where insights and knowledge are extracted from data through 
the application of cybersecurity data science. In this section, we particularly focus on 
machine learning-based modeling as machine learning techniques can significantly 
change the cybersecurity landscape. The security features or attributes and their patterns 
in data are of high interest to be discovered and analyzed to extract security insights. 
To achieve the goal, a deeper understanding of data and machine learning-based ana-
lytical models utilizing a large number of cybersecurity data can be effective. Thus, vari-
ous machine learning tasks can be involved in this model building layer according to 
the solution perspective. These are - security feature engineering that mainly responsi-
ble to transform raw security data into informative features that effectively represent the 
underlying security problem to the data-driven models. Thus, several data-processing 
tasks such as feature transformation and normalization, feature selection by taking into 
account a subset of available security features according to their correlations or impor-
tance in modeling, or feature generation and extraction by creating new brand principal 
components, may be involved in this module according to the security data characteris-
tics. For instance, the chi-squared test, analysis of variance test, correlation coefficient 
analysis, feature importance, as well as discriminant and principal component analysis, 
or singular value decomposition, etc. can be used for analyzing the significance of the 
security features to perform the security feature engineering tasks [82].
Another significant module is security data clustering that uncovers hidden patterns 
and structures through huge volumes of security data, to identify where the new threats 
exist. It typically involves the grouping of security data with similar characteristics, 
which can be used to solve several cybersecurity problems such as detecting anoma-
lies, policy violations, etc. Malicious behavior or anomaly detection module is typically

Page 21 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 21

Page 21 of 29
Sarker et al. J Big Data            (2020) 7:41

responsible to identify a deviation to a known behavior, where clustering-based analysis 
and techniques can also be used to detect malicious behavior or anomaly detection. In 
the cybersecurity area, attack classification or prediction is treated as one of the most 
significant modules, which is responsible to build a prediction model to classify attacks 
or threats and to predict future for a particular security problem. To predict denial-of-
service attack or a spam filter separating tasks from other messages, could be the rel-
evant examples. Association learning or policy rule generation module can play a role to 
build an expert security system that comprises several IF-THEN rules that define attacks. 
Thus, in a problem of policy rule generation for rule-based access control system, asso-
ciation learning can be used as it discovers the associations or relationships among a set 
of available security features in a given security dataset. The popular machine learning 
algorithms in these categories are briefly discussed in “ Machine learning tasks in cyber-
security” section. The module model selection or customization is responsible to choose 
whether it uses the existing machine learning model or needed to customize. Analyz-
ing data and building models based on traditional machine learning or deep learning 
methods, could achieve acceptable results in certain cases in the domain of cybersecu-
rity. However, in terms of effectiveness and efficiency or other performance measure-
ments considering time complexity, generalization capacity, and most importantly the 
impact of the algorithm on the detection rate of a system, machine learning models are 
needed to customize for a specific security problem. Moreover, customizing the related 
techniques and data could improve the performance of the resultant security model and 
make it better applicable in a cybersecurity domain. The modules discussed above can 
work separately and combinedly depending on the target security problems.

Incremental learning and dynamism
In our framework, this layer is concerned with finalizing the resultant security model 
by incorporating additional intelligence according to the needs. This could be possible 
by further processing in several modules. For instance, the post-processing and improve-
ment module in this layer could play a role to simplify the extracted knowledge accord-
ing to the particular requirements by incorporating domain-specific knowledge. As 
the attack classification or prediction models based on machine learning techniques 
strongly rely on the training data, it can hardly be generalized to other datasets, which 
could be significant for some applications. To address such kind of limitations, this mod-
ule is responsible to utilize the domain knowledge in the form of taxonomy or ontology 
to improve attack correlation in cybersecurity applications.
Another significant module recency mining and updating security model is responsible 
to keep the security model up-to-date for better performance by extracting the latest 
data-driven security patterns. The extracted knowledge discussed in the earlier layer is 
based on a static initial dataset considering the overall patterns in the datasets. However, 
such knowledge might not be guaranteed higher performance in several cases, because 
of incremental security data with recent patterns. In many cases, such incremental data 
may contain different patterns which could conflict with existing knowledge. Thus, the 
concept of RecencyMiner [170] on incremental security data and extracting new pat-
terns can be more effective than the existing old patterns. The reason is that recent

Page 22 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 22

Page 22 of 29
Sarker et al. J Big Data            (2020) 7:41

security patterns and rules are more likely to be significant than older ones for predict-
ing cyber risks or attacks. Rather than processing the whole security data again, recency-
based dynamic updating according to the new patterns would be more efficient in terms 
of processing and outcome. This could make the resultant cybersecurity model intelli-
gent and dynamic. Finally, response planning and decision making module is responsible 
to make decisions based on the extracted insights and take necessary actions to prevent 
the system from the cyber-attacks to provide automated and intelligent services. The 
services might be different depending on particular requirements for a given security 
problem.
Overall, this framework is a generic description which potentially can be used to dis-
cover useful insights from security data, to build smart cybersecurity systems, to address 
complex security challenges, such as intrusion detection, access control management, 
detecting anomalies and fraud, or denial of service attacks, etc. in the area of cybersecu-
rity data science.

Discussion
Although several research efforts have been directed towards cybersecurity solutions, 
discussed in “ Background” , “Cybersecurity data science”, and “Machine learning tasks 
in cybersecurity” sections in different directions, this paper presents a comprehensive 
view of cybersecurity data science. For this, we have conducted a literature review to 
understand cybersecurity data, various defense strategies including intrusion detection 
techniques, different types of machine learning techniques in cybersecurity tasks. Based 
on our discussion on existing work, several research issues related to security datasets, 
data quality problems, policy rule generation, learning methods, data protection, feature 
engineering, security alert generation, recency analysis etc. are identified that require 
further research attention in the domain of cybersecurity data science.
The scope of cybersecurity data science is broad. Several data-driven tasks such as 
intrusion detection and prevention, access control management, security policy genera-
tion, anomaly detection, spam filtering, fraud detection and prevention, various types of 
malware attack detection and defense strategies, etc. can be considered as the scope of 
cybersecurity data science. Such tasks based categorization could be helpful for secu-
rity professionals including the researchers and practitioners who are interested in the 
domain-specific aspects of security systems [171]. The output of cybersecurity data 
science can be used in many application areas such as Internet of things (IoT) security 
[173], network security [174], cloud security [175], mobile and web applications [26], 
and other relevant cyber areas. Moreover, intelligent cybersecurity solutions are impor-
tant for the banking industry, the healthcare sector, or the public sector, where data 
breaches typically occur [36, 176]. Besides, the data-driven security solutions could also 
be effective in AI-based blockchain technology, where AI works with huge volumes of 
security event data to extract the useful insights using machine learning techniques, and 
block-chain as a trusted platform to store such data [177].
Although in this paper, we discuss cybersecurity data science focusing on examin-
ing raw security data to data-driven decision making for intelligent security solutions, 
it could also be related to big data analytics in terms of data processing and decision 
making. Big data deals with data sets that are too large or complex having characteristics

Page 23 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 23

Page 23 of 29
Sarker et al. J Big Data            (2020) 7:41

of high data volume, velocity, and variety. Big data analytics mainly has two parts con-
sisting of data management involving data storage, and analytics [178]. The analytics 
typically describe the process of analyzing such datasets to discover patterns, unknown 
correlations, rules, and other useful insights [179]. Thus, several advanced data analy-
sis techniques such as AI, data mining, machine learning could play an important role 
in processing big data by converting big problems to small problems [180]. To do this, 
the potential strategies like parallelization, divide-and-conquer, incremental learning, 
sampling, granular computing, feature or instance selection, can be used to make better 
decisions, reducing costs, or enabling more efficient processing. In such cases, the con-
cept of cybersecurity data science, particularly machine learning-based modeling could 
be helpful for process automation and decision making for intelligent security solutions. 
Moreover, researchers could consider modified algorithms or models for handing big 
data on parallel computing platforms like Hadoop, Storm, etc. [181].
Based on the concept of cybersecurity data science discussed in the paper, building a 
data-driven security model for a particular security problem and relevant empirical eval-
uation to measure the effectiveness and efficiency of the model, and to asses the usability 
in the real-world application domain could be a future work.

Conclusion
Motivated by the growing significance of cybersecurity and data science, and machine 
learning technologies, in this paper, we have discussed how cybersecurity data sci-
ence applies to data-driven intelligent decision making in smart cybersecurity systems 
and services. We also have discussed how it can impact security data, both in terms 
of extracting insight of security incidents and the dataset itself. We aimed to work on 
cybersecurity data science by discussing the state of the art concerning security incidents 
data and corresponding security services. We also discussed how machine learning tech-
niques can impact in the domain of cybersecurity, and examine the security challenges 
that remain. In terms of existing research, much focus has been provided on traditional 
security solutions, with less available work in machine learning technique based security 
systems. For each common technique, we have discussed relevant security research. The 
purpose of this article is to share an overview of the conceptualization, understanding, 
modeling, and thinking about cybersecurity data science.
We have further identified and discussed various key issues in security analysis to 
showcase the signpost of future research directions in the domain of cybersecurity data 
science. Based on the knowledge, we have also provided a generic multi-layered frame-
work of cybersecurity data science model based on machine learning techniques, where 
the data is being gathered from diverse sources, and the analytics complement the latest 
data-driven patterns for providing intelligent security services. The framework consists 
of several main phases - security data collecting, data preparation, machine learning-
based security modeling, and incremental learning and dynamism for smart cybersecu-
rity systems and services. We specifically focused on extracting insights from security 
data, from setting a research design with particular attention to concepts for data-driven 
intelligent security solutions.

Page 24 of 29
Sarker et al. J Big Data (2020) 7:41. 

Scene 24

Page 24 of 29
Sarker et al. J Big Data            (2020) 7:41

Overall, this paper aimed not only to discuss cybersecurity data science and relevant 
methods but also to discuss the applicability towards data-driven intelligent decision 
making in cybersecurity systems and services from machine learning perspectives. 
Our analysis and discussion can have several implications both for security research-
ers and practitioners. For researchers, we have highlighted several issues and directions 
for future research. Other areas for potential research include empirical evaluation of 
the suggested data-driven model, and comparative analysis with other security systems. 
For practitioners, the multi-layered machine learning-based model can be used as a ref-
erence in designing intelligent cybersecurity systems for organizations. We believe that 
our study on cybersecurity data science opens a promising path and can be used as a 
reference guide for both academia and industry for future research and applications in 
the area of cybersecurity.

Abbreviations
DS: Data science; ML: Machine learning; AI: Artificial Intelligence; CDS: Cybersecurity data science; ICT: Information and 
communication technology; IoT: Internet of Things; DDoS: Distributed Denial of Service; IDS: Intrusion detection system; 
IPS: Intrusion prevention system; HIDS: Host-based intrusion detection systems; NIDS: Network Intrusion Detection 
Systems; SIDS: Signature-based intrusion detection system; AIDS: Anomaly-based intrusion detection system.

Cybersecurity data science: an overview from machine learning perspective

Scene 1 (0s)

Scene 2 (1m 15s)

Scene 3 (2m 40s)

Scene 4 (3m 59s)

Scene 5 (5m 24s)

Scene 6 (6m 45s)

Scene 7 (8m 11s)

Scene 8 (9m 29s)

Scene 9 (10m 41s)

Scene 10 (12m 10s)

Scene 11 (13m 31s)

Scene 12 (14m 50s)

Scene 13 (16m 13s)

Scene 14 (17m 42s)

Scene 15 (19m 4s)

Scene 16 (20m 5s)

Scene 17 (21m 23s)

Scene 18 (22m 31s)

Scene 19 (23m 33s)

Scene 20 (25m 2s)

Scene 21 (26m 32s)

Scene 22 (28m 1s)

Scene 23 (29m 31s)

Scene 24 (30m 58s)

Scene 25 (32m 13s)

Scene 26 (33m 21s)

Scene 27 (34m 28s)

Scene 28 (35m 36s)

Scene 29 (36m 43s)