Estudio comparativo de metodologías de detección de intrusos basadas en anomalías de red aplicando redes neuronales SOM y GHSOM
Cargando...
Archivos
Fecha
2016
Autores
Mardini Bovea, Johan
Galeano Llanos, Nicolás
Título de la revista
ISSN de la revista
Título del volumen
Editor
Ediciones Universidad Simón Bolívar
Facultad de Ingenierías
Facultad de Ingenierías
Resumen
El uso de internet y de las redes informáticas ha crecido considerablemente en los últimos años, tanto a nivel empresarial como a nivel doméstico, convirtiendo a la información en uno de los activos más importantes que poseen los usuarios. Sin embargo, el incremento en el uso de las tecnologías de la información y la comunicación, ha desencadenado un crecimiento en el número de accesos intrusivos y ataques dirigidos a los sistemas informáticos. Situación, que ha aumentado con los años, evidenciando la vulnerabilidad de tales sistemas.
La existencia de programas que afectan a computadoras tanto a nivel local como a nivel de toda la red informática, ha conllevado a diseñar y desarrollar diferentes estrategias preventivas y correctivas para subsanar problemas relativos a la seguridad informática. Esta dinámica ha sido importante para el entendimiento de la estructura de los ataques y de la mejor manera de contrarrestarlos, procurando que su impacto sea menos al esperado por el atacante.
La principal motivación de este proyecto de investigación ha sido la implementación del método wrapper (envoltorio) aplicado a los sistemas de detección de intrusos con el propósito de mejorar las tasas de detección de ataques en sistemas de redes computacionales, utilizando un procedimiento de selección de características y métodos de algoritmos de entrenamiento no supervisados. Las técnicas de selección buscan identificar las características más relevantes y en consecuencia utilizar la que más incide en el proceso de clasificación, generando una reducción en la carga computacional, sin disminuir la eficiencia del proceso de clasificación de tráfico normal y anómalo.
En esta investigación se evalúan diferentes métricas que miden 'la calidad del modelo de detección de intrusiones propuesto, mediante procesos de simulación, empleando el dataset DARPA NSL-KDD. Ello implica la aplicación previa de las técnicas de selección de características CHI-SQUARE e INFO.GAIN, con el propósito de identificar las características relevantes y que mejor inciden en el proceso de clasificación de las conexiones de datos.
En consecuencia, se entrenó una red neuronal que utiliza un algoritmo de aprendizaje no supervisado basado en mapas auto-organizativos (SOM y GHSOM), con el propósito de clasificar el tráfico de red bi-clase de forma automática. Como resultado se obtuvo que al utilizar el clasificador GHSOM con validación cruzada 10 pliegues, sin importar que técnicas de selección de características se utilizó, entre CHI-SQUARE e INFO.GAIN. Ambas técnicas coinciden en que el número de características óptimo es 15.
El aporte de esta investigación es la integración de las técnicas CHI-SQUARE e INFO.GAIN con las técnicas de clasificación basadas en Redes Neuronales Artificiales SOM y GHSOM, en un modelo funcional que fundamenta futuros desarrollos en materia de Sistemas de Detección de Intrusos- IDS, impactando a la creciente comunidad investigadora en temas relacionados a la seguridad informática.
The use of the Internet and computer networks has grown considerably in recent years, both at corporate level and at the domestic level, making the information in one of the most important assets owned by users. However, the increased use of information and communications technology, has triggered a growth in the number of intrusive access and attacks on computer systems. Situation, which has increased over the years, demonstrating the vulnerability of such systems. The existence of computer programs involving both local and wide computer network, has led to design and develop different preventive and corrective to address problems related to information security strategies. This dynamic has been important for the understanding of the structure of the attacks and the best way to counter them, ensuring that its impact is less than expected by the attacker. The main motivation for this research project has been the implementation of the wrapper method (wrapper) applied to systems intrusion detection in order to improve detection rates of attacks on systems of computer networks, using a selection procedure features and methods of unsupervised training algorithms. Selection techniques seek to identify the most important characteristics and therefore use that most affects the classification process, generating a reduction in the computational load, without decreasing the efficiency of the classification process of normal and abnormal traffic. In this research different metrics that measure the quality of the model proposed intrusion detection, process simulation by using the DARPA dataset NSL-KDD are evaluated. This implies the prior application of feature selection techniques CHI-SQUARE and INFO.GAIN, in order to identify the relevant characteristics and better influence the classification process connections datos.En result, a network was trained neuronal using a learning algorithm based on non-supervised self-organizing maps (SOM and GHSOM), with the purpose of classifying traffic bi-class network automatically. As a result it was found that when using the classifier GHSOM with 10-fold cross-validation, regardless of feature selection techniques used, including CHI-SQUARE and INFO.GAIN. Both techniques agree that the optimal number of features is 15. The contribution of this research is the integration of the CHI-SQUARE and INFO.GAIN techniques with classification techniques based on Artificial Neural Networks SOM and GHSOM in a functional model future developments based on Detection Systems IDS intruders, impacting the growing community research on issues related to computer security.
The use of the Internet and computer networks has grown considerably in recent years, both at corporate level and at the domestic level, making the information in one of the most important assets owned by users. However, the increased use of information and communications technology, has triggered a growth in the number of intrusive access and attacks on computer systems. Situation, which has increased over the years, demonstrating the vulnerability of such systems. The existence of computer programs involving both local and wide computer network, has led to design and develop different preventive and corrective to address problems related to information security strategies. This dynamic has been important for the understanding of the structure of the attacks and the best way to counter them, ensuring that its impact is less than expected by the attacker. The main motivation for this research project has been the implementation of the wrapper method (wrapper) applied to systems intrusion detection in order to improve detection rates of attacks on systems of computer networks, using a selection procedure features and methods of unsupervised training algorithms. Selection techniques seek to identify the most important characteristics and therefore use that most affects the classification process, generating a reduction in the computational load, without decreasing the efficiency of the classification process of normal and abnormal traffic. In this research different metrics that measure the quality of the model proposed intrusion detection, process simulation by using the DARPA dataset NSL-KDD are evaluated. This implies the prior application of feature selection techniques CHI-SQUARE and INFO.GAIN, in order to identify the relevant characteristics and better influence the classification process connections datos.En result, a network was trained neuronal using a learning algorithm based on non-supervised self-organizing maps (SOM and GHSOM), with the purpose of classifying traffic bi-class network automatically. As a result it was found that when using the classifier GHSOM with 10-fold cross-validation, regardless of feature selection techniques used, including CHI-SQUARE and INFO.GAIN. Both techniques agree that the optimal number of features is 15. The contribution of this research is the integration of the CHI-SQUARE and INFO.GAIN techniques with classification techniques based on Artificial Neural Networks SOM and GHSOM in a functional model future developments based on Detection Systems IDS intruders, impacting the growing community research on issues related to computer security.
Descripción
Palabras clave
Dataset DARPA NSL-KDD, Sistema de Detección de Intrusiones - IDS, Técnicas de entrenamiento y clasificación, Redes Neuronales Artificiales SOM y GHSOM, Técnicas de selección de características, Dataset DARPA NSL-KDD, Intrusion detection system-IDS, Training techniques and classification, Artificial neural network-SOM and GHSOM, Feature selection techniques