Xgboost-Based Multi-Steps Cybersecurity Attacks Detection Model

References

[1] Timeline / Work Plan100%

[2] POSSIBLE OUTPUT OF THE PROJECT

[3] Message Scan (SMS / Chat Message Detection)

[4] Functionality: Detects phishing, scam, or malicious messages using NLP features (keywords, sentiment, suspicious patterns).

[5] Output Examples:

[6] "safe_message" → No suspicious content detected. "phishing_message" → Contains suspicious link & scam keywords.

[7] URL Scan (Malicious Link Detection)

[8] Functionality: Analyzes URLs for phishing/malware distribution using domain reputation, WHOIS data, and lexical features.

[9] Output Examples:

[10] "benign_url" → Reputable domain, no phishing signs.

[11] "malicious_url" → Domain blacklisted; URL resembles known phishing patterns.

[12] APK Scan (Malware Detection in Android Apps)

[13] Functionality: Static and dynamic APK analysis (permissions, API calls, bytecode features). Output Examples:

[14] "benign_apk" → Normal permissions, no known malicious signatures.

[15] "malicious_apk" → Requests excessive sensitive permissions; matches known malware family.

[16] Spam Call Detector

[17] Functionality: Detects telemarketing, scam, or robocalls using caller ID analysis, call frequency, and user reports.

[18] Output Examples:

[19] "normal_call" → Number not in spam lists, normal call frequency.

[20] "spam_call" → Matches spam database; suspicious calling patterns detected

[21] Multi-Step Detection Integration

[22] Functionality: Links suspicious events across categories (e.g., a phishing message contains a malicious URL leading to an APK download → results in a spam call).

[23] Output Example:

[24] { "stage_1": "phishing_message_detected", "stage_2": "malicious_url_detected", "stage_3": "malicious_apk_detected", "stage_4": "spam_call_detected",

[25] "verdict": "multi-step_attack_detected"

[26] }

[27] CONCLUSION

[28] This research investigates the implementation of algorithms for selecting features to categorize cyber-attacks. Simulations were conducted on 128799 samples from the MSCAD database, which has 67 attributes including details about most common network variables, protocols, and attacking diversity. The method of implementation includes separate processes such as pre-processing cleaning up data, partitioning data into sets to be used for training and testing, picking features, and creating classification algorithms. Finally, nine distinct classification methods such as RF, KNN, NB, DT, XGB, and CatBoost, were used for categorizing key features to recognize attacks on networks and obtain better detection outcomes. Based on their effectiveness, the performance analysis uses F1-score, Recall, Accuracy, and Precision to evaluate each technique's efficiency. Based on the obtained results, Random Forest and XBG algorithms are the most effective Web Attacks classifiers regarding the AUC. For future work, even yet, this strategy is not feasible in applications that operate in real-time. Such a problem may be solved by implementing capabilities that aggregate data from the network's sensors in an instantaneous manner and give conclusions based on Machine Learning approaches.

@article{1710416,
      author = {Abhishek Hiremath, Latha P H, Chethan J, Dinesh S, Harshitha S},
      title = {Xgboost-Based Multi-Steps Cybersecurity Attacks Detection Model},
      journal = {Iconic Research And Engineering Journals},
      year = {2025},
      volume = {9},
      number = {3},
      pages = {621-625},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1710416.pdf},
      abstract = {Millions of businesses have begun to use the web in the last twenty years as an inexpensive way to connect with customers and carry out transactions with customers. Cloud-based electronic storage and information databases are commonly used on the internet. It retains information that consumers freely submit via web-based management sites, purchasing carts, logging inputs, and exploration and submitting forms. Simply, these programs, as common as they are, are highly susceptible to cyber threats and attacks that are performed by hackers. Concurrently with these advancements, developing a dependable web-based app is a challenging endeavor fraught with difficulties. Malware and other cyber threats to the privacy, security, and accessibility of networked devices are types of that threats that are challenging for web-based business sites.},
      month = {September},
  }