Intelligent intrusion detection system

• Autor(a) principal: Marques, Fernando Emanuel Ferreira
• Data de Publicação: 2021
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10773/33939
• topic: Monitoring; Network traffic analysis; User behavior analysis; Intrusion detection systems; Machine learning; Anomaly detection

Currently, multiple personal machines and network systems suffer some type of computer attack with possible motivations related to computer power abuse, information tampering or vandalism. Despite the existence of intrusion detection systems, there are some barriers to their application in real scenarios, such as the difficulty in tracing user behavioral profiles, the ability to camouflage various attacks in the network and the time it takes to recognize the signatures used by new attacks. In the case of studying behavioral profiles, there is research and work in various areas such as social networks, recommendation systems, medical health and user authentication. This dissertation proposes an anomaly detection system based on the behavioral analysis of a user on the network. After extracting network traffic metrics related to the network and transport layers of the OSI model, the calculation of features that will be used as input for learning models, such as the One-Class Support Vector Machine, is performed. The work was developed using two types of network traffic: user traffic and anomaly traffic. Considered normal traffic, user traffic was captured using a switch with port mirroring in a corporate environment. To test the models in the detection task, two types of anomalies were considered: manipulation of information by transferring files and executing commands remotely in the terminal via an SSH session. In a first phase, the anomaly traffic was generated in an isolated way, to simulate a scenario in which the intrusion is the only active traffic in the network. For the case of file transfer anomaly, the results obtained have perfect F1-score with no percentage of false positives. In a second phase, anomaly traffic is camouflaged with the user’s normal traffic, in a scenario where anomaly occurs when there is external activity on the network. The results demonstrate that the anomaly is clearly more difficult to detect, for the case of the mixed file transfer anomaly, with F1-score of 0.010 and percentage of false positives of 0.86 %.