Automatização de processos de machine learning do framework DNS para a detecção de domínios maliciosos

• Autor(a) principal: Gardini, Victor Fernandes
• Data de Publicação: 2022
• Tipo de documento: Trabalho de conclusão de curso
• Idioma: por
• Título da fonte: Repositório Institucional da UNESP
• Texto Completo: http://hdl.handle.net/11449/216224
• topic: Cybersecurity; Machine learning; Automation; DNS framework; Cibersegurança; MLOps; Automatização; Framework DNS

The use of domain names for the practice of malicious activities on the internet is a problem faced on a global scale, with emphasis on Brazil, which is in the ranking of countries most affected by phishing-type cyberattacks. To solve this, several approaches are studied by academia, among them the use of machine learning to classify domains as malicious or legitimate stands out. To deal with this, it was proposed to classify domains in three stages, where each one of them is interconnected through a single system called DNS framework. The system allows training new models and submitting new datasets for the training step, however the previous models and lists are lost. Therefore, approaches used by the academic community were studied that culminated in a set of techniques and approaches to manage machine learning models, these practices are commonly grouped and defined by the term MLOps. From that, it was possible to build a new system with the capacity to store, version and monitor models, lists and system logs, being later integrated with the framework. In this way, ensuring that each of the stages can have, independently, their training sets built incrementally from well-defined operations, without causing the loss of the previous process, in addition, allowing the creation of new models through an automated pipeline, so that it is made available to the production environment.