Caracterização de tráfego de intrusões por meio de algoritmo de aprendizagem profunda

Abstract

Machine learning algorithms, especially deep learning algorithms, are being applied in several areas of knowledge, such as image processing, video, voice, text and computer network traffic analysis. Computer networks and services offered to users in general have attracted the attention of attackers, generating a significant increase in potential damage to such services. To solve this problem, Intrusion Detection Systems are used to prevent attacks. However, there are still flaws in the detection, with a high false positive index. In this context, this work proposes a Deep Learning model, called Tree-CNN (SRS), which detects anomalous traffic, increasing the accuracy in the classification of DDoS attacks, Infiltration, Web and Brute force, cited as the main attacks on computer networks. For this, the results obtained with the proposed model were compared to the results obtained with the algorithms Naive Bayes, Random Forest, Decision Tree, Support Vector Machine, Multilayer Perceptron, Convolutional Neural Networks and Deep Belief Networks, where the proposed model obtained superior results in all scenarios, thus reducing the number of false positives in the classification of network traffic. In the captured traffic, some characteristics of the most common attacks were analyzed, using attribute selection techniques and Principal Component Analysis to reduce dimensionality.