Geração de workload para treinamento, teste, avaliação e comparação de sistemas de detecção de intrusão baseado na replicação de características estatísticas
Resumo
Este artigo apresenta o resultado de um trabalho de geração de datasets para sistemas de detecção de intrusão. Este processo utiliza datasets existentes constituídos por pacotes, assim como suas características estatísticas. A modelagem da distribuição de variáveis como, por exemplo, o número de pacotes contíguos de mesmo rótulo, é responsável pela geração de novas estruturas, as quais preservam características estatísticas semelhantes. Como resultado, obtivemos uma nova base de dados, que pode ser utilizada não apenas para o treinamento e teste de novos sistemas de detecção, mas também para a reavaliação de outros sistemas previamente desenvolvidos. Isto possibilita a comparação com os resultados de novos trabalhos.
Palavras-chave:
Segurança, Detecção de Intrusos, Avaliação
Referências
Barbieri, S. (2019). Método para a detecção de pacotes produzidos por scanning tcp. Mestrado em engenharia eletrônica e computação, Instituto Tecnológico de Aeronáutica, São José dos Campos, SP.
Fontugne, R., Borgnat, P., Abry, P., and Fukuda, K. (2010). Mawilab: Combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking. In Proceedings of the 6th International COnference, Co-NEXT '10, pages 8:1-8:12, New York, NY, USA. ACM.
Gharib, A., Sharafaldin, I., Lashkari, A. H., and Ghorbani, A. A. (2016). An evaluation framework for intrusion detection dataset. In 2016 International Confe-rence on Information Science and Security (ICISS), pages 1-6.
Glatz, E. and Dimitropoulos, X. (2012). Classifying internet one-way traffic. In Proceedings of the 2012 Internet Measurement Conference, IMC'12.
Haider, W., Hu, J., Slay, J., Turnbull, B., and Xie, Y. (2017). Generating realistic intrusion detection system dataset based on fuzzy qualitative modeling. J. Netw. Comput. Appl., 87(C):185-192.
Idzikowski, F., Chiaraviglio, L., Liu, W., and van de Beek, J. (2018). Future internet architectures and sustainability: An overview. In 2018 IEEE Internatio-nal Conference on Environmental Engineering (EE), pages 1-5.
Lee, Y. and Lee, Y. (2012). Toward scalable internet traffic measurement and analysis with hadoop. SIGCOMM Comput. Commun. Rev., 43(1):5-13.
Lippmann, R., Haines, J. W., Fried, D. J., Korba, J., and Das, K. (2000). The 1999 darpa off-line intrusion detection evaluation. Comput. Netw., 34(4):579-595.
McHugh, J. (2000). Testing intrusion detection systems: A critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Trans. Inf. Syst. Secur., 3(4):262-294.
Nehinbe, J. O. (2011). A critical evaluation of datasets for investigating idss and ipss researches. In 2011 IEEE 10th International Conference on Cybernetic Intelligent Systems (CIS), pages 92-97.
Rao, C. M. and Naidu, M. M. (2017). A model for generating synthetic network flows and accuracy index for evaluation of anomaly network intrusion detection systems. Indian Journal of Science and Technology, 10(14).
Scott, P. D. and Wilkins, E. (1999). Evaluating data mining proce-dures: techniques for generating artificial data sets. Information & Software Technology, 41(9):579-587.
Sharafaldin, I., Gharib, A., Lashkari, A. H., and Ghorbani, A. A. (2017). Towards a reliable intrusion detection benchmark dataset. Software Networking, 2017(1):177-200.
Shiravi, A., Shiravi, H., Tavallaee, M., and Ghorbani, A. A. (2012). Toward developing a systematic approach to generate benchmark datasets for intrusion detection. Comput. Secur., 31(3):357-374.
Sommer, R. and Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE Symposium on Security and Privacy, pages 305-316.
Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A. A. (2009). A detailed analysis of the kdd cup 99 data set. In 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pages 1-6.
Zuech, R., Khoshgoftaar, T. M., Seliya, N., Najafabadi, M. M., and Kemp, C. (2015). A new intrusion detection benchmarking system. In The Twenty-Eighth International Flairs Conference.
Fontugne, R., Borgnat, P., Abry, P., and Fukuda, K. (2010). Mawilab: Combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking. In Proceedings of the 6th International COnference, Co-NEXT '10, pages 8:1-8:12, New York, NY, USA. ACM.
Gharib, A., Sharafaldin, I., Lashkari, A. H., and Ghorbani, A. A. (2016). An evaluation framework for intrusion detection dataset. In 2016 International Confe-rence on Information Science and Security (ICISS), pages 1-6.
Glatz, E. and Dimitropoulos, X. (2012). Classifying internet one-way traffic. In Proceedings of the 2012 Internet Measurement Conference, IMC'12.
Haider, W., Hu, J., Slay, J., Turnbull, B., and Xie, Y. (2017). Generating realistic intrusion detection system dataset based on fuzzy qualitative modeling. J. Netw. Comput. Appl., 87(C):185-192.
Idzikowski, F., Chiaraviglio, L., Liu, W., and van de Beek, J. (2018). Future internet architectures and sustainability: An overview. In 2018 IEEE Internatio-nal Conference on Environmental Engineering (EE), pages 1-5.
Lee, Y. and Lee, Y. (2012). Toward scalable internet traffic measurement and analysis with hadoop. SIGCOMM Comput. Commun. Rev., 43(1):5-13.
Lippmann, R., Haines, J. W., Fried, D. J., Korba, J., and Das, K. (2000). The 1999 darpa off-line intrusion detection evaluation. Comput. Netw., 34(4):579-595.
McHugh, J. (2000). Testing intrusion detection systems: A critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Trans. Inf. Syst. Secur., 3(4):262-294.
Nehinbe, J. O. (2011). A critical evaluation of datasets for investigating idss and ipss researches. In 2011 IEEE 10th International Conference on Cybernetic Intelligent Systems (CIS), pages 92-97.
Rao, C. M. and Naidu, M. M. (2017). A model for generating synthetic network flows and accuracy index for evaluation of anomaly network intrusion detection systems. Indian Journal of Science and Technology, 10(14).
Scott, P. D. and Wilkins, E. (1999). Evaluating data mining proce-dures: techniques for generating artificial data sets. Information & Software Technology, 41(9):579-587.
Sharafaldin, I., Gharib, A., Lashkari, A. H., and Ghorbani, A. A. (2017). Towards a reliable intrusion detection benchmark dataset. Software Networking, 2017(1):177-200.
Shiravi, A., Shiravi, H., Tavallaee, M., and Ghorbani, A. A. (2012). Toward developing a systematic approach to generate benchmark datasets for intrusion detection. Comput. Secur., 31(3):357-374.
Sommer, R. and Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE Symposium on Security and Privacy, pages 305-316.
Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A. A. (2009). A detailed analysis of the kdd cup 99 data set. In 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pages 1-6.
Zuech, R., Khoshgoftaar, T. M., Seliya, N., Najafabadi, M. M., and Kemp, C. (2015). A new intrusion detection benchmarking system. In The Twenty-Eighth International Flairs Conference.
Publicado
24/09/2019
Como Citar
RODRIGUES, Moisés da Silva; BARBIERI, Sidnei ; PARENTE DE OLIVEIRA, José ; MARCONDES, Cesar A.; PEREIRA JR, Lourenco Alves.
Geração de workload para treinamento, teste, avaliação e comparação de sistemas de detecção de intrusão baseado na replicação de características estatísticas. In: WORKSHOP DE SEGURANÇA CIBERNÉTICA EM DISPOSITIVOS CONECTADOS (WSCDC), 2. , 2019, Gramado.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2019
.
p. 1-11.
DOI: https://doi.org/10.5753/wscdc.2019.7701.
