Sistema de Detecção de Intrusão Confiável Baseado em Aprendizagem por Fluxo
Resumo
Sistemas de detecção de intrusão baseados em aprendizagem de máquina são amplamente propostos na literatura. Porém, apesar dos resultados promissores reportados, devido a falta de confiabilidade na acurácia dos sistemas, tais técnicas raramente são utilizadas em produção. Neste artigo, propomos um sistema de detecção de intrusão confiável baseado em algoritmos de aprendizagem por fluxo. A confiabilidade do sistema é provida através da avaliação da confiança da classificação efetuada pelo sistema. Experimentos demonstraram a viabilidade de proposta, que manteve a sua acurácia mesmo durante a classificação de novos ataques e serviços, atualizando o sistema de modo autônomo.Referências
Moa. available online. Acessado 22 de dezembro de 2020.
Abreu, V., Santin, A. O., Viegas, E. K., and Stihler, M. (2017). A multi-domain role activation model. In 2017 IEEE International Conference on Communications (ICC). IEEE.
dos Santos, R. R., Viegas, E. K., Santin, A., and Cogo, V. V. (2020). A long-lasting reinforcement learning intrusion detection model. In Advanced Information Networking and Applications, pages 1437–1448. Springer International Publishing.
Gates, C. and Taylor, C. (2007). Challenging the anomaly detection paradigm: A provocative discussion. pages 21–29. Proc. 2006 Work. New Secur. Paradig.
He, H., Chen, S., Li, K., and Xu, X. (2011). Incremental learning from stream data. pages 1901–1914. IEEE Trans. Neural Netw. 22.
Kugler, E., Santin, A. O., Cogo, V. V., and Abreu, V. (2020). A reliable semi-supervised intrusion detection model: One year of network traffic anomalies. In ICC 2020 - 2020 IEEE International Conference on Communications (ICC). IEEE.
Loganathan, G., Samarabandu, J., and Wang, X. (2018). Real-time intrusion detection in network traffic using adaptive and auto-scaling stream processor. In 2018 IEEE Global Communications Conference (GLOBECOM). IEEE.
Muallem, A., Shetty, S., Hong, L., and Pan, J. (2019). Tddeht: Threat detection using distributed ensembles of hoeffding trees on streaming cyber datasets. pages 219–224. Proc. - IEEE Mil. Commun. Conf. MILCOM.
Peng, J., Choo, K.-K. R., and Ashman, H. (2016). User profiling in intrusion detection: A review. volume 72, pages 14–27. Elsevier BV.
Peng, K., Leung, V., and Huang, Q. (2018). Clustering approach based on mini batch kmeans for intrusion detection system over big data. pages 11897–11906. IEEE Access.
P.Singh and Venkatesan, M. (2018). Hybrid approach for intrusion detection system. pages 1–5. Proc. 2018 Int. Conf. Curr. Trends Towar. Converging Technol. ICCTCT.
Sommer, R. and Paxson, R. (2010). Outside the closed world: On using machine learning for network intrusion detection. pages 305–316. IEEE Symp. Secur. Priv.s.
Sovilj, D., Budnarain, P., Sanner, S., Salmon, G., and Rao, M. (2020). A comparative evaluation of unsupervised deep architectures for intrusion detection in sequential data streams. volume 159, page 113577. Elsevier BV.
Tan, S., Ting, K., and Liu, T. (2011). Fast anomaly detection for streaming data. pages 1511–1516. IJCAI International Joint Conference on Artificial Intelligence, vol. 22.
Tavallaee, M., Stakhanova, N., and Ghorbani, A. A. (2010). Toward credible evaluation of anomaly-based intrusion-detection methods. pages 516–524. IEEE Trans. Syst. Man Cybern. 5.
Tobi, A. and Duncan, I. (2019). Improving intrusion detection model prediction by threshold adaptation. pages 1–42. Information.
Viegas, E., Santin, A., and Abreu, N. N. A. (2017a). A resilient stream learning intrusion detection mechanism for real-time analysis of network traffic. page 978–983. IEEE Glob. Telecommun. Conf. GLOBECOM.
Viegas, E., Santin, A., Bessani, A., and Neves, N. (2019). BigFlow: Real-time and reliable anomaly-based intrusion detection for high-speed networks. Future Generation Computer Systems, 93:473–485.
Viegas, E. K., Santin, A. O., and Oliveira, L. S. (2017b). Toward a reliable anomaly-based intrusion detection in real-world environments. Computer Networks, 127:200–216.
Yin, C., Xia, L., Zhang, S., Sun, R., and Wang, J. (2017). Improved clustering algorithm based on high-speed network data stream. volume 22, pages 4185–4195. Springer Science and Business Media LLC.
Abreu, V., Santin, A. O., Viegas, E. K., and Stihler, M. (2017). A multi-domain role activation model. In 2017 IEEE International Conference on Communications (ICC). IEEE.
dos Santos, R. R., Viegas, E. K., Santin, A., and Cogo, V. V. (2020). A long-lasting reinforcement learning intrusion detection model. In Advanced Information Networking and Applications, pages 1437–1448. Springer International Publishing.
Gates, C. and Taylor, C. (2007). Challenging the anomaly detection paradigm: A provocative discussion. pages 21–29. Proc. 2006 Work. New Secur. Paradig.
He, H., Chen, S., Li, K., and Xu, X. (2011). Incremental learning from stream data. pages 1901–1914. IEEE Trans. Neural Netw. 22.
Kugler, E., Santin, A. O., Cogo, V. V., and Abreu, V. (2020). A reliable semi-supervised intrusion detection model: One year of network traffic anomalies. In ICC 2020 - 2020 IEEE International Conference on Communications (ICC). IEEE.
Loganathan, G., Samarabandu, J., and Wang, X. (2018). Real-time intrusion detection in network traffic using adaptive and auto-scaling stream processor. In 2018 IEEE Global Communications Conference (GLOBECOM). IEEE.
Muallem, A., Shetty, S., Hong, L., and Pan, J. (2019). Tddeht: Threat detection using distributed ensembles of hoeffding trees on streaming cyber datasets. pages 219–224. Proc. - IEEE Mil. Commun. Conf. MILCOM.
Peng, J., Choo, K.-K. R., and Ashman, H. (2016). User profiling in intrusion detection: A review. volume 72, pages 14–27. Elsevier BV.
Peng, K., Leung, V., and Huang, Q. (2018). Clustering approach based on mini batch kmeans for intrusion detection system over big data. pages 11897–11906. IEEE Access.
P.Singh and Venkatesan, M. (2018). Hybrid approach for intrusion detection system. pages 1–5. Proc. 2018 Int. Conf. Curr. Trends Towar. Converging Technol. ICCTCT.
Sommer, R. and Paxson, R. (2010). Outside the closed world: On using machine learning for network intrusion detection. pages 305–316. IEEE Symp. Secur. Priv.s.
Sovilj, D., Budnarain, P., Sanner, S., Salmon, G., and Rao, M. (2020). A comparative evaluation of unsupervised deep architectures for intrusion detection in sequential data streams. volume 159, page 113577. Elsevier BV.
Tan, S., Ting, K., and Liu, T. (2011). Fast anomaly detection for streaming data. pages 1511–1516. IJCAI International Joint Conference on Artificial Intelligence, vol. 22.
Tavallaee, M., Stakhanova, N., and Ghorbani, A. A. (2010). Toward credible evaluation of anomaly-based intrusion-detection methods. pages 516–524. IEEE Trans. Syst. Man Cybern. 5.
Tobi, A. and Duncan, I. (2019). Improving intrusion detection model prediction by threshold adaptation. pages 1–42. Information.
Viegas, E., Santin, A., and Abreu, N. N. A. (2017a). A resilient stream learning intrusion detection mechanism for real-time analysis of network traffic. page 978–983. IEEE Glob. Telecommun. Conf. GLOBECOM.
Viegas, E., Santin, A., Bessani, A., and Neves, N. (2019). BigFlow: Real-time and reliable anomaly-based intrusion detection for high-speed networks. Future Generation Computer Systems, 93:473–485.
Viegas, E. K., Santin, A. O., and Oliveira, L. S. (2017b). Toward a reliable anomaly-based intrusion detection in real-world environments. Computer Networks, 127:200–216.
Yin, C., Xia, L., Zhang, S., Sun, R., and Wang, J. (2017). Improved clustering algorithm based on high-speed network data stream. volume 22, pages 4185–4195. Springer Science and Business Media LLC.
Publicado
13/10/2020
Como Citar
VIEGAS, Eduardo K.; SANTIN, Altair O.; SANTOS, Roger R. dos; ABREU, Vilmar.
Sistema de Detecção de Intrusão Confiável Baseado em Aprendizagem por Fluxo. In: SIMPÓSIO BRASILEIRO DE SEGURANÇA DA INFORMAÇÃO E DE SISTEMAS COMPUTACIONAIS (SBSEG), 20. , 2020, Petrópolis.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2020
.
p. 382-394.
DOI: https://doi.org/10.5753/sbseg.2020.19251.
