Análise de detecção de intrusões usando clusterização

• Autor(a) principal: Watanabe, Victor Matos [UNESP]
• Data de Publicação: 2019
• Tipo de documento: Trabalho de conclusão de curso
• Idioma: por
• Título da fonte: Repositório Institucional da UNESP
• Texto Completo: http://hdl.handle.net/11449/203727; http://www.athena.biblioteca.unesp.br/exlibris/bd/capelo/2019-09-12/000924493.pdf
• topic: Infra-estrutura de dados espaciais; Análise por agrupamento; Sistemas de detecção de intrusão (Medidas de segurança); Intrusion detection systems (Computer security)

of attacks and intrusions becomes relevant. The Intrusion Detection Systems (or IDS) emerged as a layer of protection against attacks, analyzing trustworthy datasets to detect those intrusions by its features and attributes. Anomaly detection is one of the concepts that the IDSs can apply to. This technique applied on IDSs aim to detect attacks by detecting activities that doesn't fit the normal activities patterns. Clustering is one of the techniques that are used so that Intrusion Detection Systems can detect patterns for those normal activities (and for the abnormal ones too). This method uses the concept of grouping data. In this undergraduate thesis, techniques to enhance the clustering itself on the IDS scope are discussed and analyzed, using techniques such as feature selection of the most relevant attributes of the dataset, and normal and abnormal detection methods. Also, methods for a better use of the KDD CUP 99 dataset are discussed. The feature selection techniques generate results that are close to the original ones in both the detection rate as the false-positive rate, while decreasing the training time. The cluster labeling techniques applied generate results that increase the general precision, reducing the false-positive rate and maintaining the detection rate stable.