Busca avançada
Ano de início
Entree


An Adaptive Real-Time Architecture for Zero-Day Threat Detection

Texto completo
Autor(es):
Pastana Lobato, Antonio Gonzalez ; Lopez, Martin Andreoni ; Sanz, Igor Jochem ; Cardenas, Alvaro A. ; Duarte, Otto Carlos M. B. ; Pujolle, Guy ; IEEE
Número total de Autores: 7
Tipo de documento: Artigo Científico
Fonte: 2018 IEEE INTERNATIONAL CONFERENCE ON COMMUNICATIONS (ICC); v. N/A, p. 6-pg., 2018-01-01.
Resumo

Attackers create new threats and constantly change their behavior to mislead security systems. In this paper, we propose an adaptive threat detection architecture that trains its detection models in real time. The major contributions of the proposed architecture are: i) gather data about zero-day attacks and attacker behavior using honeypots in the network; ii) process data in real time and achieve high processing throughput through detection schemes implemented with stream processing technology; iii) use of two real datasets to evaluate our detection schemes, the first from a major network operator in Brazil and the other created in our lab; iv) design and development of adaptive detection schemes including both online trained supervised classification schemes that update their parameters in real time and learn zero-day threats from the honeypots, and online trained unsupervised anomaly detection schemes that model legitimate user behavior and adapt to changes. The performance evaluation results show that proposed architecture maintains an excellent trade-off between threat detection and false positive rates and achieves high classification accuracy of more than 90%, even with legitimate behavior changes and zero-day threats. (AU)

Processo FAPESP: 15/24485-9 - Internet do futuro aplicada a cidades inteligentes
Beneficiário:Fabio Kon
Modalidade de apoio: Auxílio à Pesquisa - Temático
Processo FAPESP: 15/24514-9 - Projeto stream: segurança em tempo real com elasticidade, analítica e monitoramento
Beneficiário:Otto Carlos Muniz Bandeira Duarte
Modalidade de apoio: Auxílio à Pesquisa - Regular
Processo FAPESP: 14/50937-1 - INCT 2014: da Internet do Futuro
Beneficiário:Fabio Kon
Modalidade de apoio: Auxílio à Pesquisa - Temático