Abordagem imunológica de segurança baseada em correlação de alertas e redes programáveis

• Autor(a) principal: Melo, Roberto Vasconcelos
• Data de Publicação: 2018
• Tipo de documento: Dissertação
• Idioma: por
• Título da fonte: Repositório Institucional da UFS
• Texto Completo: http://ri.ufs.br/jspui/handle/riufs/10758
• topic: Sistema imunológico artificial; Sistema de detecção de intrusão; Sistema de prevenção de intrusão; Rede definida por software (SDN); Comutação em nuvem; Artificial immune system (AIS); Intrusion detection system (IDS); Intrusion prevent system (IPS); Cloud computing; Software-defined networking (SDN); CIENCIAS EXATAS E DA TERRA::CIENCIA DA COMPUTACAO

In the security field, anomaly detection techniques have been developed to detect traffic patterns related to attacks or malicious activities and are often referred to as anomalies. Particularly, some anomalies can represent attackers launching Distributed Denial-of-Service (DDoS) in order to degrade services availability. Threats in the DoS category can involve early-stage actions such as probe attacks. In this type of attack, a network is scanned in order to find vulnerable hosts and compromise them. As a result, the detected vulnerabilities enable unauthorized access to the machines through user to root (U2R) and remote to local (R2L) attacks. The compromised machines could be used in order to cause a denial of service against a particular target. These attack classes include threats that can hide in normal traffic due to low required attack intensity. In addition, anomaly-based detection techniques have a high false alarm rate, which helps in reducing the detection efficiency. This work aims to present a security model with detection and prevention functions against attacks that exploit the vulnerabilities of the cloud infrastructure to mitigate the previously mentioned problems. This model consists of the concepts of immunology, alert correlation, and software-defined networks (SDN). It consists of a distributed intrusion detection system based on anomaly detection within the artificial immune system (AIS) approach and attack graph correlation. Through this approach, an anomaly-based intrusion detection system inside the AIS field works with attack graph based correlation. The Negative Selection, Clonal Selection and Immune Network algorithms are used to implement an agent-based detection system to analyze network traffic. The described system works in conjunction with attack graphs and an alert correlation algorithm which can aid in the false alarm reduction rate. Attack graphs can also aid in the countermeasure selection through SDN technology. The SDN countermeasures can assist in attack prevention through traffic redirection, traffic isolation, network topology change, and IP address change. The proposed system was tested through the network traffic collected from the virtual machines on Amazon Web Service (AWS). The collected traffic data was converted to datasets in the NSL-KDD format. The addition of alert correlation technique in the proposed security approach increased detection efficiency for all studied attack classes.