Um Sistema de Detecção de Ameaças Distribuídas de Rede baseado em Aprendizagem por Grafos

• Igor Jochem Sanz UFRJ
• Martin Andreoni Lopez UFRJ
• Gabriel Antonio Fontes Rebello UFRJ
• Otto Carlos Muniz Bandeira Duarte UFRJ

DOI: https://doi.org/10.5753/sbrc.2018.2487

Abstract

The increase of Internet of Things connected devices results in vulerabilities exploitation attacks at unimaginable scales. Therefore, effectively detecting port scan techniques and distributed denial of service attacks becomes essential. This paper proposes a intrusion detection system for distributed threat detection in real time based on a graph-learning approach. Different metrics are extracted from a graph analysis of the incoming traffic samples, resumed in time windows, to be incorporated into the inital flow features before being preprocessed. The proposed system is evaluated through three traffic datasets: real traffic of a Brazlian network operator and a synthetic traffic produced in our lab. Results show that the enrichment by graph analysis improved the detection accuracy on up to 15,7%. On some scenarios, using only graph-enriched features reduced the number of false negatives on up to 1430 times.

References

Akamai (2017). Q4 2016 State of the internet / security report. Technical Report 4, Akamai. Disponível em: https://content.akamai.com/pg7967-q4-soti-security-report.html.

Andreoni Lopez, M., Sanz, I. J., Menezes, D. M., Duarte, O. C. M. B., and Pujolle, G. (2017a). CATRACA: uma Ferramenta para Classicação e Análise Tráfego Escalável In Salão de Ferramentas do XVII Simpósio Baseada em Processamento por Fluxo. Brasileiro de Segurança da Informação e de Sistemas Computacionais SBSeg’2017, pages 788–795.

Andreoni Lopez, M., Silva, R. S., Alvarenga, I. D., Rebello, G. A. F., Sanz, I. J., Lobato, A. G. P., Mattos, D. M. F., Duarte, O. C. M. B., and Pujolle, G. (2017b). Collecting and Characterizing a Real Broadband Access Network Trafc Dataset. In IEEE/IFIP 1st Cyber Security in Networking Conference (CSNet’17), Rio de Janeiro, Brazil.

Buczak, A. and Guven, E. (2015). A survey of data mining and machine learning IEEE Communications Surveys Tumethods for cyber security intrusion detection. torials, (99):1–26.

Chowdhury, S., Khanzadeh, M., Akula, R., Zhang, F., Zhang, S., Medal, H., Marufuzzaman, M., and Bian, L. (2017). Botnet detection using graph-based feature clustering. Journal of Big Data, 4(1):14.

Iliofotou, M., Kim, H.-c., Faloutsos, M., Mitzenmacher, M., Pappu, P., and Varghese, G. (2011). Graption: A graph-based P2P trafc classication framework for the internet backbone. Computer Networks, 55(8):1909–1920.

Karagiannis, T., Papagiannaki, K., and Faloutsos, M. (2005). BLINC: multilevel trafc classication in the dark. In ACM SIGCOMM Computer Communication Review, volume 35, pages 229–240. ACM.

Kolias, C., Kambourakis, G., Stavrou, A., and Voas, J. (2017). DDoS in the IoT: Mirai and other botnets. Computer, 50(7):80–84.

Lakhina, A., Crovella, M., and Diot, C. (2005). Mining anomalies using trafc feature distributions. In ACM SIGCOMM Computer Communication Review, volume 35, pages 217–228. ACM.

Liu, L., Saha, S., Torres, R., Xu, J., Tan, P.-N., Nucci, A., and Mellia, M. (2014). Detecting malicious clients in ISP networks using HTTP connectivity graph and ow information. In IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM), pages 150–157. IEEE.

Lobato, A. G. P., Andreoni Lopez, M., and Duarte, O. C. M. B. (2016). Um sistema acurado de detecção de ameaças em tempo real por processamento de uxos. In XXXIV Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos-SBRC’2016, Salvador, Bahia.

Lobato, A. G. P., Andreoni Lopez, M., Rebello, G. A. F., and Duarte, O. C. M. B. (2017). Um Sistema Adaptativo de Detecção e Reação a Ameaças. In Anais do XVII Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais SBSeg’17, pages 400–413.

Nguyen, T. T. and Armitage, G. (2008). A survey of techniques for internet trafc classication using machine learning. Commun. Surveys Tuts., 10(4):56–76.

Sanz, J. I., Andreoni Lopez, M. E., Mattos, D. M. F., and Duarte, O. C. M. B. (2017). A Cooperation-Aware Virtual Network Function for Proactive Detection of Distributed Port Scanning. In IEEE/IFIP 1st Cyber Security in Networking Conference (CSNet’17).