Modelo para análise de comportamento de usuário em computador pessoal utilizando aprendizado de máquina

Abstract

Intrusion detection systems are an important monitoring tool to alert administrators to possible intrusion attempts, whether for use in logical network environments or simply on a local device. In some environments such as corporate, educational and/or financial environments, legitimate users may seek internal information and use it to exploit security breaches in an attempt to invade a system or computer network, whether motivated by simple curiosity, discontent or even to cause damage. The purpose of this paper is to present a model for analyzing user behavior based on legitimate local accounts created in the Windows operating system, which, guided by a set of rules, techniques and tactics from global knowledge of MITRE | ATT&C, can help system administrators better understand the behavior of these users, through the collection and analysis of local events provided by the operating system. The Los Alamos Laboratory dataset (hostEvents) provides the logs of local Windows accounts for the simulated test environment prepared with characteristics and configurations close to the real environment, such as the use of events generated by the same operating system. To define normal and abnormal behaviors for a local account, a database called signatures is used, which has several lines representing predefined behavioral characteristics, which are generated by the mathematical combination technique. In addition, the machine learning algorithms Support Vector Machine (SVM), K-Nearest Neighbors (KNN) and Naive Bayes (NB) are used to classify the normal and abnormal behaviors of the accounts. The analysis of the results demonstrated that the proposed model met its general objective. It was also found that the algorithms used in the simulated environment obtained satisfactory results, with emphasis on the SVM, which presented the best performance and the lowest false positive rate (FP) among its peers.