Detecção de intrusão sobre pacotes utilizando algoritmos de fluxos contínuos de dados

Abstract

Intrusion Detection Systems (IDSs) help protect computer networks by identify and detect attempts to obtain unauthorized access to data via computer networks by inspecting packets separately or in the context of flows. Considering that the intrusion detection process is a classification task of continuously stream-generated packets in a non-stationary distribution, security analysis must constantly update decision models to identify changes in attack behaviors and normal traffic of a network. Since improving models usually requires labeled instances, which demands significant effort from security specialists, the purpose of this work is to contribute to the development of real-world IDSs. Therefore, our goal is to: i) compare the use of individual packets and network flows in the intrusion detection task by analyzing the predictive performance of data stream classifiers; ii) analyze the impact of delayed labelling for updating the models on the classifiers’ performance; and iii) evaluate the impact of active learning strategies on the classifiers’ performance. Our experimental evaluation used the CICIDS2017 dataset, different data stream classification algorithms, and five evaluation measures. Experiments have shown packet-based IDSs perform similarly to flow-based IDSs. Based on this result, we studied different active learning techniques to estimate the impact of delayed labelling on packet-based IDSs. The performance of the classifiers is inversely proportional as the label delivery rate. Besides, the active learning strategies helped keep the performance at a satisfactory level, even with a small set of labeled instances.