Aplicação e Análise Comparativa do Desempenho de Classificadores de Padrões para o Sistema de Detecção de Intrusão Snort
Resumo
Com a evolução da Internet, o volume de dados que trafegam nas redes de computadores cresce dia após dia, desafiando a segurança de sistemas computacionais do mundo todo. Dentre as principais ferramentas utilizadas para assegurar esses sistemas, destacam-se os Sistemas de Detecção de Intrusão (SDI). Em um ambiente onde novas vulnerabilidades são descobertas toda semana [Symantec 2015], detecções por anomalia podem reduzir os danos de ataques desconhecidos. Desta forma, este trabalho propõs a aplicação de dois classificadores de padrões para substituir o esquema de detecção do SDI código-aberto Snort. O estudo comparativo focado no desempenho de ambas as técnicas apresentou altas taxas de acurácias nas classificações de conexões.
Referências
Amato, F., Mazzocca, N., Moscato, F., and Vivenzio, E. (2017). Multilayer perceptron: An intelligent model for classication and intrusion detection. In Advanced Information Networking and Applications Workshops (WAINA), 2017 31st International Conference on, pages 686–691. IEEE.
Biles, S. (2003). Detecting the unknown with snort and the statistical packet anomaly detection engine (spade). Computer Security Online Ltd., Tech. Rep.
Canadian Institute for Cybersecurity (2012). Intrusion detection evaluation dataset (iscxids2012).
da Silva, J. R. C. (2007). Redes neurais articiais para sistemas de detecção de intrusos.
de Leon F de Carvalho, A. P. (2009). Redes neurais articiais.
Devi, S. and Nagpal, R. (2012). Intrusion detection system using genetic algorithm-a review. International Journal of Computing & Business Research.
Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., and Vázquez, E. (2009). Anomaly-based network intrusion detection: Techniques, systems and challenges. computers & security, 28(1):18–28.
Jaggim, R. and Sangade, J. (2014). Detecting and classifying attacks using articial neural network. International Journal on Recent and Innovation Trends in Computing and Communication ISSN, pages 1136–1142.
Kumar, K. and Punia, R. (2013). Improving the performance of ids using genetic algorithm. International Journal of Computer Science and Communication, 4(2).
Kurose, J. F. and Ross, K. W. (2010). Redes de Computadores e a Internet: uma abordagem top-down. Pearson.
Minsky, M. and Papert, S. (1969). Perceptrons.
Papa, J. and Falcão, A. (2009). LibOPF: A library for the design of optimum-path forest classiers.
Papa, J. P. and Falcão, A. X. (2010). Optimum-path forest: A novel and powerful framework for supervised graphbased pattern recognition techniques. Institute of Computing University of Campinas, pages 41–48.
Papa, J. P., Falcão, A. X., and Suzuki, C. T. (2009). Supervised pattern classication based on optimum-path forest. International Journal of Imaging Systems and Technology, 19(2):120–131.
Pereira, C. R. (2012). Detecção de intrusão em redes de computadores utilizando oresta de caminhos ótimos.
Planquart, J.-P. (2001). Application of neural networks to intrusion detection. SANS Institute.
Salem, M. and Buehler, U. (2013). Reinforcing network security by converting massive data ow to continuous connections for ids. In Internet Technology and Secured Transactions (ICITST), 2013 8th International Conference for, pages 570–575. IEEE.
Symantec (2015). A new zero-day vulnerability discovered every week in 2015.
Tanenbaum, A. S. (2003). Redes de computadoras. Pearson educación.
Van Efferen, L. and Ali-Eldin, A. M. (2017). A multi-layer perceptron approach for owIn Networks, Computers and Communications (ISNCC), based anomaly detection. 2017 International Symposium on, pages 1–6. IEEE.
Biles, S. (2003). Detecting the unknown with snort and the statistical packet anomaly detection engine (spade). Computer Security Online Ltd., Tech. Rep.
Canadian Institute for Cybersecurity (2012). Intrusion detection evaluation dataset (iscxids2012).
da Silva, J. R. C. (2007). Redes neurais articiais para sistemas de detecção de intrusos.
de Leon F de Carvalho, A. P. (2009). Redes neurais articiais.
Devi, S. and Nagpal, R. (2012). Intrusion detection system using genetic algorithm-a review. International Journal of Computing & Business Research.
Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., and Vázquez, E. (2009). Anomaly-based network intrusion detection: Techniques, systems and challenges. computers & security, 28(1):18–28.
Jaggim, R. and Sangade, J. (2014). Detecting and classifying attacks using articial neural network. International Journal on Recent and Innovation Trends in Computing and Communication ISSN, pages 1136–1142.
Kumar, K. and Punia, R. (2013). Improving the performance of ids using genetic algorithm. International Journal of Computer Science and Communication, 4(2).
Kurose, J. F. and Ross, K. W. (2010). Redes de Computadores e a Internet: uma abordagem top-down. Pearson.
Minsky, M. and Papert, S. (1969). Perceptrons.
Papa, J. and Falcão, A. (2009). LibOPF: A library for the design of optimum-path forest classiers.
Papa, J. P. and Falcão, A. X. (2010). Optimum-path forest: A novel and powerful framework for supervised graphbased pattern recognition techniques. Institute of Computing University of Campinas, pages 41–48.
Papa, J. P., Falcão, A. X., and Suzuki, C. T. (2009). Supervised pattern classication based on optimum-path forest. International Journal of Imaging Systems and Technology, 19(2):120–131.
Pereira, C. R. (2012). Detecção de intrusão em redes de computadores utilizando oresta de caminhos ótimos.
Planquart, J.-P. (2001). Application of neural networks to intrusion detection. SANS Institute.
Salem, M. and Buehler, U. (2013). Reinforcing network security by converting massive data ow to continuous connections for ids. In Internet Technology and Secured Transactions (ICITST), 2013 8th International Conference for, pages 570–575. IEEE.
Symantec (2015). A new zero-day vulnerability discovered every week in 2015.
Tanenbaum, A. S. (2003). Redes de computadoras. Pearson educación.
Van Efferen, L. and Ali-Eldin, A. M. (2017). A multi-layer perceptron approach for owIn Networks, Computers and Communications (ISNCC), based anomaly detection. 2017 International Symposium on, pages 1–6. IEEE.
Publicado
10/05/2018
Como Citar
UTIMURA, Luan N.; COSTA, Kelton A..
Aplicação e Análise Comparativa do Desempenho de Classificadores de Padrões para o Sistema de Detecção de Intrusão Snort. In: SIMPÓSIO BRASILEIRO DE REDES DE COMPUTADORES E SISTEMAS DISTRIBUÍDOS (SBRC), 36. , 2018, Campos do Jordão.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2018
.
p. 337-350.
ISSN 2177-9384.
DOI: https://doi.org/10.5753/sbrc.2018.2426.
