Home // INTERNET 2020, The Twelfth International Conference on Evolving Internet // View article
Authors:
Alexandre Croix
Thibault Debatty
Wim Mees
Keywords: Machine learning; neural network; aggregation functions; webshell
Abstract:
In this paper, we compare the efficiency of two binary classifiers. The first one uses the Weighted Ordered Weighted Averaging (WOWA) aggregation function whose coefficients are learned thanks to a genetic algorithm. The second is based on an artificial neural network trained by a backpropagation algorithm. They are trained to be used in a multi-criteria decision system. These kind of multi-criteria system are more and more common in the cyber-defence field. In this work, we compare the performance of these two classifiers by using two criteria: Area Under the Curve of a Receiver Operating Characteristics (ROC) curve and the Area Under the Curve of a Precision-Recall (P-R) curve. This second criterion is more adapted for imbalanced dataset what is often the case in the cyber-security field. We perform a complete parameter study of these classifiers to optimize their performance. The dataset used for this work is a pool of Hypertext Preprocessor (PHP) files analyzed by a multi-agent PHP webshell detector. We obtain different good results, especially for neural networks and highlights the advantage of the genetic algorithm method that allows a physical interpretation of the result.
Pages: 41 to 47
Copyright: Copyright (c) IARIA, 2020
Publication date: October 18, 2020
Published in: conference
ISSN: 2308-443X
ISBN: 978-1-61208-796-2
Location: Porto, Portugal
Dates: from October 18, 2020 to October 22, 2020