Análise de Séries Temporais Multivariadas para Detecção de Intrusão em Nuvens Computacionais
Resumo
Apesar das inúmeras vantagens oferecidas por serviços de computação em nuvem, aspectos de segurança constituem um dos pontos críticos ao se considerar adotar este tipo de serviço. Novos métodos de detecção de intrusão têm sido propostos para mitigar ataques direcionados às várias camadas da arquitetura de nuvem. Neste trabalho, apresentamos um sistema de detecção de intrusão para nuvens do modelo IaaS. A abordagem baseia-se na análise de métricas de desempenho obtidas por meio de técnicas de introspecção de máquina virtual, permitindo a monitoramento de clientes a partir da máquina hospedeira. Anomalias são identificadas tratando-se os dados coletados como séries temporais multivariadas.
Referências
Avallone, S., Guadagno, S., Emma, D., Pescape, A., and Ventre, G. (2004). D-ITG distributed internet traffic generator. In First International Conference on the Quantitative Evaluation of Systems, 2004. QEST 2004. Proceedings., pages 316–317.
Avritzer, A., Tanikella, R., James, K., Cole, R. G., and Weyuker, E. (2010). Monitoring for security intrusion using performance signatures. In Proceedings of the First Joint WOSP/SIPEW International Conference on Performance Engineering,WOSP/SIPEW ’10, pages 93–104, New York, NY, USA. ACM.
Barford, P. and Crovella, M. (1998). Generating representative web workloads for network and server performance evaluation. In Proceedings of the 1998 ACM SIGMEXVII Joint International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS ’98/PERFORMANCE ’98, pages 151–160, New York, NY, USA. ACM.
Benoudjit, N., Archambeau, C., Lendasse, A., Lee, J. A., Verleysen, M., et al. (2002). Width optimization of the gaussian kernels in radial basis function networks. In ESANN, volume 2, pages 425–432.
Cheng, H., Tan, P. N., Potter, C., and Klooster, S. (2008). A robust graph-based algorithm for detection and characterization of anomalies in noisy multivariate time series. In 2008 IEEE International Conference on Data Mining Workshops, pages 349–358.
Ferreira, A. S. (2013). Uma arquitetura para monitoramento de segurança baseada em acordos de níveis de serviço para nuvens de infraestrutura. Master’s thesis, Universidade Estadual de Campinas, Instituto de Computação, Campinas, SP, Brasil.
Li, J.-B., Wang, Y.-H., Chu, S.-C., and Roddick, J. F. (2014). Kernel self-optimization learning for kernel-based feature extraction and recognition. Information Sciences, 257:70–80.
Liao, H.-J., Lin, C.-H. R., Lin, Y.-C., and Tung, K.-Y. (2013). Intrusion detection system: A comprehensive review. Journal of Network and Computer Applications, 36(1):16–24.
Mah, B. A. (1997). An empirical model of http network traffic. In INFOCOM ’97. Sixteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Driving the Information Revolution., Proceedings IEEE, volume 2, pages 592–600.
Megyesi, P., Szabó, G., and Molnár, S. (2015). User behavior based traffic emulator: A framework for generating test data for dpi tools. Computer Networks, 92:41–54.
Modi, C., Patel, D., Borisaniya, B., Patel, H., Patel, A., and Rajarajan, M. (2013). A survey of intrusion detection techniques in cloud. Journal of Network and Computer Applications, 36(1):42–57.
Nikolai, J. and Wang, Y. (2014). Hypervisor-based cloud intrusion detection system. In Computing, Networking and Communications (ICNC), 2014 International Conference on, pages 989–993.
Patel, A., Taghavi, M., Bakhtiyari, K., and Júnior, J. C. (2013). An intrusion detection and prevention system in cloud computing: A systematic review. Journal of Network and Computer Applications, 36(1):25–41.
Vishwanath, K. V. and Vahdat, A. (2009). Swing: Realistic and responsive network traffic generation. IEEE/ACM Trans. Netw., 17(3):712–725.
Wu, K.-P. and Wang, S.-D. (2009). Choosing the kernel parameters for support vector machines by the inter-cluster distance in the feature space. Pattern Recognition, 42(5):710–717.
Zhu, Y. and Zheng, Y. (2008). Research on intrusion detection system based on pattern recognition. In Networked Computing and Advanced Information Management, 2008. NCM ’08. Fourth International Conference on, volume 1, pages 609–612.
Avritzer, A., Tanikella, R., James, K., Cole, R. G., and Weyuker, E. (2010). Monitoring for security intrusion using performance signatures. In Proceedings of the First Joint WOSP/SIPEW International Conference on Performance Engineering,WOSP/SIPEW ’10, pages 93–104, New York, NY, USA. ACM.
Barford, P. and Crovella, M. (1998). Generating representative web workloads for network and server performance evaluation. In Proceedings of the 1998 ACM SIGMEXVII Joint International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS ’98/PERFORMANCE ’98, pages 151–160, New York, NY, USA. ACM.
Benoudjit, N., Archambeau, C., Lendasse, A., Lee, J. A., Verleysen, M., et al. (2002). Width optimization of the gaussian kernels in radial basis function networks. In ESANN, volume 2, pages 425–432.
Cheng, H., Tan, P. N., Potter, C., and Klooster, S. (2008). A robust graph-based algorithm for detection and characterization of anomalies in noisy multivariate time series. In 2008 IEEE International Conference on Data Mining Workshops, pages 349–358.
Ferreira, A. S. (2013). Uma arquitetura para monitoramento de segurança baseada em acordos de níveis de serviço para nuvens de infraestrutura. Master’s thesis, Universidade Estadual de Campinas, Instituto de Computação, Campinas, SP, Brasil.
Li, J.-B., Wang, Y.-H., Chu, S.-C., and Roddick, J. F. (2014). Kernel self-optimization learning for kernel-based feature extraction and recognition. Information Sciences, 257:70–80.
Liao, H.-J., Lin, C.-H. R., Lin, Y.-C., and Tung, K.-Y. (2013). Intrusion detection system: A comprehensive review. Journal of Network and Computer Applications, 36(1):16–24.
Mah, B. A. (1997). An empirical model of http network traffic. In INFOCOM ’97. Sixteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Driving the Information Revolution., Proceedings IEEE, volume 2, pages 592–600.
Megyesi, P., Szabó, G., and Molnár, S. (2015). User behavior based traffic emulator: A framework for generating test data for dpi tools. Computer Networks, 92:41–54.
Modi, C., Patel, D., Borisaniya, B., Patel, H., Patel, A., and Rajarajan, M. (2013). A survey of intrusion detection techniques in cloud. Journal of Network and Computer Applications, 36(1):42–57.
Nikolai, J. and Wang, Y. (2014). Hypervisor-based cloud intrusion detection system. In Computing, Networking and Communications (ICNC), 2014 International Conference on, pages 989–993.
Patel, A., Taghavi, M., Bakhtiyari, K., and Júnior, J. C. (2013). An intrusion detection and prevention system in cloud computing: A systematic review. Journal of Network and Computer Applications, 36(1):25–41.
Vishwanath, K. V. and Vahdat, A. (2009). Swing: Realistic and responsive network traffic generation. IEEE/ACM Trans. Netw., 17(3):712–725.
Wu, K.-P. and Wang, S.-D. (2009). Choosing the kernel parameters for support vector machines by the inter-cluster distance in the feature space. Pattern Recognition, 42(5):710–717.
Zhu, Y. and Zheng, Y. (2008). Research on intrusion detection system based on pattern recognition. In Networked Computing and Advanced Information Management, 2008. NCM ’08. Fourth International Conference on, volume 1, pages 609–612.
Publicado
06/11/2017
Como Citar
CHOJI, Mayk Fernando; GEUS, Paulo Lício de.
Análise de Séries Temporais Multivariadas para Detecção de Intrusão em Nuvens Computacionais. In: SIMPÓSIO BRASILEIRO DE SEGURANÇA DA INFORMAÇÃO E DE SISTEMAS COMPUTACIONAIS (SBSEG), 17. , 2017, Brasília.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2017
.
p. 112-125.
DOI: https://doi.org/10.5753/sbseg.2017.19494.
