The Role of Machine Learning for Detecting Malicious Internet Traffic

With the blistering development of the Internet, encrypted communication, cloud environments, and IoT systems, the magnitude and complexity of fraudulent network traffic have grown dramatically. Intrusion detection systems that rely on signature-based detection mechanisms are increasingly less effective due to the use of encryption, protocol obfuscation, and distributed device ecosystems by modern attackers to hide the malicious behaviour. With the increase in the heterogeneity and high-volume network environments, adaptive, behaviour-oriented mechanisms of detection have become paramount. The major difficulty is in the analysis of high-dimensional, highly encrypted, imbalanced, and distorted by sampling or incomplete visibility malicious traffic. Most network flows have finer behavioural deviations as opposed to explicit payload signatures. Further, IoT devices produce vast amounts of unreliable, resource-limited traffic and encrypted messages conceal content-based features. These circumstances compromise the performance of the conventional methods of detection and demand more sophisticated modelling strategies. The study focuses on critically reviewing how machine learning can be