Uma proposta para detecção distribuída de intrusões utilizando mineração em fluxos de ambientes big data

Abstract

With the enormous expansion of computer networks, the need to protect data and information that travels over the web has increased. The growth in volume, speed, and variety of data requires an intrusion detection system that is more robust, accurate, and capable of analyzing a huge amount of data. This work proposes the creation of an intrusion detection system using a distributed architecture. The system uses three layers of classification of sample streams, collected from the network, where each classification layer can be composed of one or more classifiers, working in parallel. Classifiers are trained with different machine-learning methods. Each layer can select the main characteristics to be used to classify the samples, and a final classification unit, the Decider, uses the voting method to determine the final classification result. The architecture uses stream classifiers, but it is possible to use traditional classifiers. The results obtained by the proposed architecture, using two databases for validation of the proposed system – NSL-KDD and CICIDS2017, show gains in accuracy of up to 18.52% and 3.55%, using the NSL-KDD and CICIDS2017 databases, respectively. Reductions in classification time of up to 35.51% and 94.90%, respectively, were obtained. A negative factor generated by the proposed work is the increase in the memory requirement, due to the use of several classifiers simultaneously, instead of just one classifier, normally used. This increase in RAM/Hour was up to 351.42% and 1016.52% for the NSL-KDD and CICIDS2017 bases, respectively.