Amalgamation of Data Science and Cyber Security

“32% of confirmed data breaches and 86% of email attacks include phishing attacks and $24.26 billion were lost in 2018 due to card payment fraud.”

The above situation where an organization's employee is involved in the attack perpetration on the network or the computers of the organization is referred as INSIDER ATTACK. Insider attack is one of the most dangerous sort of attack for any company.

Before starting with anything, let's first talk about data science and cyber security.

WHAT IS DATA SCIENCE?

Data Science is the interdisciplinary field that deals with the programming, domain expertise, algorithm, scientific methods and systems to extract significant evidence and insights from either structured or unstructured data. The term interdisciplinary is used because it is the confluence of mathematics and statistics, computer science and business knowledge.

Data is something that cannot be confined in limits, it has a vast category- images, text, videos, voice, speech, and many more.- all are data and are divided as structured, unstructured, and semi-structured. Today’s time, when the number of electrical gadgets is on rise, are throwing out a tremendous amount of data. With the Data Science, it has became feasible to process the data and yank a valuable treatment of the problems. It includes

• Data Collection: Data is collected from various sources that are mandatory and related to the problem solving


• Data Cleaning: It includes removing the incorrect data, handling NULL values and then normalized to be used.


• Data Understanding: The data is need to be comprehended so that a proper analysis and training model could be deployed.


• Data Training: It include creation of model with a proper algorithm and trained with the data sets.


• Visualization: The outcome of the data is then visualized and the results are organized on basis.

Data Science in CYBERSECURITY

The data and Data Science is found useful in finding out the antidotes of various cyber threats. One such application of Data Science is in PHISHING DETECTION.

Phishing is the most common threat in cyber security where user himself permits the mal-actors to steal sensitive information. Refer to the link below, to know more about phishing.

Phishing- A guide to identification and prevention

Data Science can identify and preventing such phishing scams in a very straightforward way. It requires the collection of data from such previous attacks and flag the message as a scam or not. The labelled data might contain the attack vectors including the link, written message, source IP, data compromised, etc. in the datasets on the basis of these, comparing the message source, links, etc. the phishing domain are determined. It also encompasses the legitimate domain(non-phishing) data. The Logistic Regression model then simply flags the message as phishing or non-phishing. It is similar like that of scam filter used by the mail providers.

Data Science can identify and preventing such phishing scams in a very straightforward way. It requires the collection of data from such previous attacks and flag the message as a scam or not. The labelled data might contain the attack vectors including the link, written message, source IP, data compromised, etc. in the datasets on the basis of these, comparing the message source, links, etc. the phishing domain are determined. It also encompasses the legitimate domain(non-phishing) data. The Logistic Regression model then simply flags the message as phishing or non-phishing. It is similar like that of scam filter used by the mail providers.

1. What is the frequency of card use, etc.


2. The location where most of the time card is used.


3. The average amount of money spent on the card.


4. What purpose card is mostly used for.

Such datasets can identify the card used in context if the card transaction is not followed by some of the data defined. It classifies the transaction as fraudulent or legitimate.

Further, the preventive measures could be applied from the ML model side like blocking the transaction or informing the legitimate user and cyber department about the transaction, its location and all.

It is not as simple as it looks like, the major trouble is collecting the valid data. It become very difficult to collect the post-attack as many hackers destroy the data like deleting the conspiracy site and leave no digital fingerprints.

Technology is playing its role and we have to play ours. Be aware of your surrounding threats and then only you can prevent yourself from such.

"...REMAIN VIGILANT, REMAIN SECURE..."