A fast and accurate threat detection and prevention architecture using stream processing

Autor(es)

Pastana Lobato, Antonio G. ^[1] ; Lopez, Martin Andreoni ^{[1, 2]} ; Cardenas, Alvaro A. ^[3] ; Duarte, Otto Carlos M. B. ^[1] ; Pujolle, Guy ^[2]

Afiliação do(s) autor(es)

^[1] Univ Fed Rio de Janeiro, GTA, COPPE, UFRJ, Rio De Janeiro - Brazil

^[2] Sorbonne Univ, Lab Informat Paris 6, CNRS, Paris - France

^[3] Univ Calif Santa Cruz, Dept Comp Sci & Engn, Santa Cruz, CA 95064 - USA

• Tipo de documento: Artigo Científico
• Fonte: CONCURRENCY AND COMPUTATION-PRACTICE & EXPERIENCE; v. 34, n. 3 AUG 2021.
• Citações Web of Science: 0

Resumo

Late detection of security breaches increases the risk of irreparable damages and limits any mitigation attempts. We propose a fast and accurate threat detection and prevention architecture that combines the advantages of real-time streaming with batch processing over a historical database. We create a dataset by capturing both legitimate and malicious traffic and propose two ways of combining packets into flows, one considering a time window and the other analyzing the first few packets of each flow per period. We also investigate the effectiveness of our proposal on real-world network traces obtained from a significant Brazilian network operator providing broadband Internet to their customers. We implement and evaluate three classification algorithms and two anomaly detection methods. The results show an accuracy higher than 95% and an excellent trade-off between attack detection and false-positive rates. We further propose an improved scheme based on software defined networks that automatically prevents threats by analyzing only the first few packets of a flow. The proposal promptly and efficiently blocks threats, is robust, and can scale up, even when the attacker employs spoofed IP. (AU)

• Processo FAPESP: 14/50937-1 - INCT 2014: da Internet do Futuro
• Beneficiário: Fabio Kon
• Modalidade de apoio: Auxílio à Pesquisa - Temático
• Processo FAPESP: 15/24485-9 - Internet do futuro aplicada a cidades inteligentes
• Beneficiário: Fabio Kon
• Modalidade de apoio: Auxílio à Pesquisa - Temático
• Processo FAPESP: 18/23292-0 - Projeto ACCRUE-SFI: infraestrutura avançada e colaborativa de pesquisa para internet do futuro segura
• Beneficiário: Otto Carlos Muniz Bandeira Duarte
• Modalidade de apoio: Auxílio à Pesquisa - Regular