Criação e análise de datasets de ataque de negação de serviço usando o MENTORED Testbed
Resumo
O uso de Testbeds em pesquisas de cibersegurança potencializa a criação de datasets representativos. Alguns trabalhos concentram-se na criação de um único dataset usando um testbed dedicado para o cenário de experimentação, o que limita a exploração de variações e exige a criação de novos testbeds para gerar novos datasets. Este trabalho descreve um fluxo que permite a criação flexível de datasets representativos usando o MENTORED Testbed e apresenta e analisa o MENTORED-SBRC2024 dataset com ataques DDoS slowloris. O fluxo proposto tem como principal destaque a possibilidade de recriar datasets, por meio de pequenas alterações nos experimentos. Para analisar a aplicabilidade e representatividade, o dataset criado foi utilizado para avaliar modelos de detecção de intrusão que usam aprendizado de máquina. Foram executadas variações de cenários de DDoS com até 352 nós.
Referências
Alomari, E., Manickam, S., Gupta, B. B., Karuppayah, S., and Alfaris, R. (2012). Botnetbased distributed denial of service (ddos) attacks on web servers: Classification and art. International Journal of Computer Applications, 49.
Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A., and Anwar, A. (2020). Ton iot telemetry dataset: A new generation dataset of iot and iiot for data-driven intrusion detection systems. Ieee Access, 8:165130–165150.
Alshaibi, A., Al-Ani, M., Al-Azzawi, A., Konev, A., and Shelupanov, A. (2022). The comparison of cybersecurity datasets. Data, 7(2):22.
Damon, E., Dale, J., Laron, E., Mache, J., Land, N., and Weiss, R. (2012). Hands-on denial of service lab exercises using slowloris and rudy. In Proceedings of the 2012 Information Security Curriculum Development Conference, InfoSecCD ’12, page 21–29, New York, NY, USA. Association for Computing Machinery.
Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L., and Janicke, H. (2022). Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning. IEEE Access, 10:40281–40306.
Gemmer, D. D., Meyer, B. H., de Mello, E. R., Schwarz, M., Wangham, M. S., and Nogueira, M. (2023). A scalable cyber security framework for the experimentation of ddos attacks of things. In NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium, pages 1–7. IEEE.
Gomez, J., Kfoury, E. F., Crichigno, J., and Srivastava, G. (2023). A survey on network simulators, emulators, and testbeds used for research and education. Computer Networks, 237:110054.
Koroniotis, N., Moustafa, N., Sitnikova, E., and Turnbull, B. (2019). Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset. Future Generation Computer Systems, 100:779–796.
Maseer, Z. K., Yusof, R., Bahaman, N., Mostafa, S. A., and Foozy, C. F. M. (2021). Benchmarking of machine learning for anomaly based intrusion detection systems in the cicids2017 dataset. IEEE access, 9:22351–22370.
Mirkovic, J. and Benzel, T. (2013). Deterlab testbed for cybersecurity research and education. Journal of Computing Sciences in Colleges, 28(4):163–163.
Moustafa, N. (2021). A new distributed architecture for evaluating ai-based security systems at the edge: Network ton iot datasets. Sustainable Cities and Society, 72:102994.
Moustis, D. and Kotzanikolaou, P. (2013). Evaluating security controls against http-based ddos attacks. In IISA 2013, pages 1–6.
Peterson, J. M., Leevy, J. L., and Khoshgoftaar, T. M. (2021). A review and analysis of the bot-iot dataset. In 2021 IEEE International Conference on Service-Oriented System Engineering (SOSE), pages 20–27.
Poniszewska-Marańda, A. and Czechowska, E. (2021). Kubernetes cluster for automating software production environment. Sensors, 21(5):1910.
Prates Jr, N. G., Andrade, A. M., de Mello, E. R., Wangham, M. S., and Nogueira, M. (2021). Um ambiente de experimentação em cibersegurança para internet das coisas. In Anais do VI Workshop do testbed FIBRE, pages 68–79. SBC.
Tsai, C.-F., Hsu, Y.-F., Lin, C.-Y., and Lin, W.-Y. (2009). Intrusion detection by machine learning: A review. expert systems with applications, 36(10):11994–12000.
Van der Maaten, L. and Hinton, G. (2008). Visualizing data using t-sne. Journal of machine learning research, 9(11).
Veksler, V. D., Buchler, N., Hoffman, B. E., Cassenti, D. N., Sample, C., and Sugrim, S. (2018). Simulations in cyber-security: a review of cognitive modeling of network attackers, defenders, and users. Frontiers in psychology, 9:691.
Yaltirakli, G. (2015). Low bandwidth dos tool. slowloris rewrite in python. [link].
Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A., and Anwar, A. (2020). Ton iot telemetry dataset: A new generation dataset of iot and iiot for data-driven intrusion detection systems. Ieee Access, 8:165130–165150.
Alshaibi, A., Al-Ani, M., Al-Azzawi, A., Konev, A., and Shelupanov, A. (2022). The comparison of cybersecurity datasets. Data, 7(2):22.
Damon, E., Dale, J., Laron, E., Mache, J., Land, N., and Weiss, R. (2012). Hands-on denial of service lab exercises using slowloris and rudy. In Proceedings of the 2012 Information Security Curriculum Development Conference, InfoSecCD ’12, page 21–29, New York, NY, USA. Association for Computing Machinery.
Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L., and Janicke, H. (2022). Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning. IEEE Access, 10:40281–40306.
Gemmer, D. D., Meyer, B. H., de Mello, E. R., Schwarz, M., Wangham, M. S., and Nogueira, M. (2023). A scalable cyber security framework for the experimentation of ddos attacks of things. In NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium, pages 1–7. IEEE.
Gomez, J., Kfoury, E. F., Crichigno, J., and Srivastava, G. (2023). A survey on network simulators, emulators, and testbeds used for research and education. Computer Networks, 237:110054.
Koroniotis, N., Moustafa, N., Sitnikova, E., and Turnbull, B. (2019). Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset. Future Generation Computer Systems, 100:779–796.
Maseer, Z. K., Yusof, R., Bahaman, N., Mostafa, S. A., and Foozy, C. F. M. (2021). Benchmarking of machine learning for anomaly based intrusion detection systems in the cicids2017 dataset. IEEE access, 9:22351–22370.
Mirkovic, J. and Benzel, T. (2013). Deterlab testbed for cybersecurity research and education. Journal of Computing Sciences in Colleges, 28(4):163–163.
Moustafa, N. (2021). A new distributed architecture for evaluating ai-based security systems at the edge: Network ton iot datasets. Sustainable Cities and Society, 72:102994.
Moustis, D. and Kotzanikolaou, P. (2013). Evaluating security controls against http-based ddos attacks. In IISA 2013, pages 1–6.
Peterson, J. M., Leevy, J. L., and Khoshgoftaar, T. M. (2021). A review and analysis of the bot-iot dataset. In 2021 IEEE International Conference on Service-Oriented System Engineering (SOSE), pages 20–27.
Poniszewska-Marańda, A. and Czechowska, E. (2021). Kubernetes cluster for automating software production environment. Sensors, 21(5):1910.
Prates Jr, N. G., Andrade, A. M., de Mello, E. R., Wangham, M. S., and Nogueira, M. (2021). Um ambiente de experimentação em cibersegurança para internet das coisas. In Anais do VI Workshop do testbed FIBRE, pages 68–79. SBC.
Tsai, C.-F., Hsu, Y.-F., Lin, C.-Y., and Lin, W.-Y. (2009). Intrusion detection by machine learning: A review. expert systems with applications, 36(10):11994–12000.
Van der Maaten, L. and Hinton, G. (2008). Visualizing data using t-sne. Journal of machine learning research, 9(11).
Veksler, V. D., Buchler, N., Hoffman, B. E., Cassenti, D. N., Sample, C., and Sugrim, S. (2018). Simulations in cyber-security: a review of cognitive modeling of network attackers, defenders, and users. Frontiers in psychology, 9:691.
Yaltirakli, G. (2015). Low bandwidth dos tool. slowloris rewrite in python. [link].
Publicado
20/05/2024
Como Citar
MEYER, Bruno Henrique; GEMMER, Davi Daniel; SANTANA, Khalil G. Q. de; FERREIRA, João Vitor; MELLO, Emerson Ribeiro de; NOGUEIRA, Michele; WANGHAM, Michelle S..
Criação e análise de datasets de ataque de negação de serviço usando o MENTORED Testbed. In: SIMPÓSIO BRASILEIRO DE REDES DE COMPUTADORES E SISTEMAS DISTRIBUÍDOS (SBRC), 42. , 2024, Niterói/RJ.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2024
.
p. 812-825.
ISSN 2177-9384.
DOI: https://doi.org/10.5753/sbrc.2024.1480.
