Sistema de detecção de intrusão baseado no algoritmo local outlier factor (LOF)

Abstract

Network intrusion detection is a growing research field within the area of Information Security. Research in this area tries to make systems and networks increasingly secure and reliable, both for end users and for other computer systems that communicate with each other. For example, when a network is invaded by a zero day attack, not only is the network that suffered the attack compromised, but also all users and other systems that use the application or service, which contains the vulnerability in question. This is a motivation for researching intrusion detection systems. One of the challenges within this area is the discovery of new standards in signatures of packets that travel over networks, which may indicate a possible breach in network security. Intrusion Detection Systems (IDS) use these signatures to detect anomalies in the networks. Network administrators can analyze a new attack, check the packets and do an analysis to find patterns and use them to update IDS detection rules. Therefore, one of the proposals for intrusion detection is the use of Unsupervised Machine Learning algorithms, which have the potential to learn patterns in data without labels and to make knowledge discoveries in datasets. In this way, the Unsupervised Machine Learning algorithms would act as a network administrator who studies packet signatures and checks patterns to detect attacks on networks. The proposal for this work is to use one of these algorithms, in particular Local Outlier Factor (LOF). The LOF applies an anomaly factor to each object within the data set and tells how far this object is in relation to a group of objects, thus detecting an anomaly. The use of LOF is expected to lead to good results, however other algorithms, also Machine Learning, can be used if the LOF proves to be unsatisfactory.