Machine Learning (In) Security - A Stream of Problems - An ML Security Challenges Review

Aug 5, 2026

Upload by Anda

Machine Learning has become central to cybersecurity, yet evaluating ML-driven defenses remains difficult because security-specific challenges often differ from other domains. The work analyzes core obstacles in applying ML to cybersecurity data, focusing on concept drift, adversarial ML, evolution effects, and delayed labels. It also examines how data collection practices influence result quality in security research, arguing for improved strategies and highlighting scenarios where existing solutions can fail. A mitigation-oriented checklist supports future system development.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages34

Reading Time1 h 26 min

AccessFree to download

Introduction

Concept drift and attacker–defender arms race

Evaluating ML-based security solutions

Key challenges in ML for cybersecurity data

Mitigations and proposed checklist

1 arXiv :2010 . 16045v2 [ cs .CR] 4 Sep 2023 Machine Learning (In) Security: A Stream of Problems FABRÍCIO CESCHIN, Federal University of Paraná, Brazil and Georgia Institute of Technology, USA MARCUS BOTACIN, Texas A&M University, USA ALBERT BIFET, University of Waikato, New Zealand BERNHARD PFAHRINGER, University of Waikato, New Zealand LUIZ S. OLIVEIRA, Federal University of Paraná, Brazil HEITOR MURILO GOMES, Victoria University of Wellington, New Zealand ANDRÉ GRÉGIO, Federal University of Paraná, Brazil Machine Learning (ML) has been widely applied to cybersecurity and is considered state-of-the-art for solving many of the open issues in that field. However, it is very difficult to evaluate how good the produced solutions are, since the challenges faced in security may not appear in other areas. One of these challenges is the concept drift, which increases the existing arms race between attackers and defenders: malicious actors can always create novel threats to overcome the defense solutions, which may not consider them in some approaches. Due to this, it is essential to know how to properly build and evaluate an ML-based security solution. In this paper, we identify, detail, and discuss the main challenges in the correct application of ML techniques to cybersecurity data. We evaluate how concept drift, evolution, delayed labels, and adversarial ML impact the existing solutions. Moreover, we address how issues related to data collection affect the quality of the results presented in the security literature, showing that new strategies are needed to improve current solutions. Finally, we present how existing solutions may fail under certain circumstances, and propose mitigations to them, presenting a novel checklist to help the development of future ML solutions for cybersecurity. CCS Concepts: • Security and privacy → Intrusion/anomaly detection and malware mitigation; Systems security; Additional Key Words and Phrases: machine learning, cybersecurity, data streams ACM Reference Format: Fabrício Ceschin, Marcus Botacin, Albert Bifet, Bernhard Pfahringer, Luiz S. Oliveira, Heitor Murilo Gomes, and André Grégio. 2023. Machine Learning (In) Security: A Stream of Problems. Digit. Threat. Res. Pract. 1, 1, Article 1 (January 2023), 34 pages. [https://doi.org/10.1145/3617897](https://doi.org/10.1145/3617897) 1 INTRODUCTION The massive amount of data produced daily demands automated solutions capable of keeping Machine Learning (ML) models updated and working properly, even with all emerging threats that constantly try to evade these Authors’ addresses: Fabrício Ceschin, [fjoceschin@inf.ufpr.br](fjoceschin@inf.ufpr.br), Federal University of Paraná, Rua Cel. Francisco H. dos Santos, 100, Curitiba, PR, 81531-980, Brazil and Georgia Institute of Technology, 756 West Peachtree Street NW, Atlanta, GA, 30308-4016, USA; Marcus Botacin, [botacin@tamu.edu](botacin@tamu.edu), Texas A&M University, Department of Computer Science & Engineering, College Station, TX, 77843-3127, USA; Albert Bifet, [abifet@waikato.ac.nz](abifet@waikato.ac.nz), University of Waikato, Department of Computer Science, Waikato, Hamilton,, New Zealand; Bernhard Pfahringer, [bernhard@waikato.ac.nz](bernhard@waikato.ac.nz), University of Waikato, Department of Computer Science, Waikato, Hamilton,, New Zealand; Luiz S. Oliveira, [lesoliveira@inf.ufpr.br](lesoliveira@inf.ufpr.br), Federal University of Paraná, Rua Cel. Francisco H. dos Santos, 100, Curitiba, PR, 81531-980, Brazil; Heitor Murilo Gomes, [heitor.gomes@vuw.ac.nz](heitor.gomes@vuw.ac.nz), Victoria University of Wellington, School of Engineering and Computer Science, Wellington,,, New Zealand; André Grégio, [gregio@inf.ufpr.br](gregio@inf.ufpr.br), Federal University of Paraná, Rua Cel. Francisco H. dos Santos, 100, Curitiba, PR, 81531-980, Brazil. Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provide

FAQs

Why is it difficult to evaluate ML-based solutions in cybersecurity?

Security challenges may not occur in other areas, and attackers continuously create novel threats, making evaluation conditions unstable. This makes it harder to judge whether produced solutions remain effective over time.

What major ML-related factors are evaluated in the paper?

The analysis covers concept drift, evolution effects, delayed labels, and adversarial ML. These factors shape how existing solutions perform on cybersecurity data streams.

How can data collection affect the quality of security research results?

Issues in collecting and representing cybersecurity data can degrade the quality of findings in the security literature. The paper argues that new strategies are needed to improve current solutions.

Aug 5, 2026

Upload by Anda