Modelo de detección de intrusos para detectar y evitar la inserción de Malware en una red, basado en técnicas de aprendizaje automático.
Fecha
2021-03
Título de la revista
ISSN de la revista
Título del volumen
Editor
Universidad de Guayaquil. Facultad de Ciencias Matemáticas y Físicas. Carrera de Ingeniería en Sistemas Computacionales.
Resumen
Los ciberataques son uno de los principales problemas que afectan a las empresas a nivel mundial.
Los causantes detrás de los ataques son conocidos como ciberdelincuentes. Estos aprovechan
vulnerabilidades existentes en los sistemas informáticos para efectuar el ataque, ocasionando robo
de información confidencial y pérdidas económicas para las empresas u organizaciones afectadas.
Es por ello que se busca una alternativa para disminuir este problema, una opción a considerar es
el aprendizaje automático como herramienta para mejorar la seguridad informática. El presente
trabajo de titulación tuvo como finalidad presentar un modelo de detección de intrusos que hace
uso de la tecnica propuesta en el presente trabajo de titulación, la cual combina las técnicas filter
y wrapper para la selección de características en la fase de preprocesamiento de datos. El conjunto
de datos utilizado para el entrenamiento y prueba de los modelos fue obtenido del repositorio
GitHub2
. Se utilizaron algoritmos de clasificación para el entrenamiento de los modelos. En base
a la métrica de exactitud se seleccionó al mejor modelo de detección de intrusos, el cual fue
entrenado mediante el algoritmo RandomForest. Este modelo consiguió una media del 99,42% de
exactitud con la técnica de selección de características propuesta, mejorando en un 0.10% al
resultado del modelo entrenado con el mismo algoritmo pero sin el uso de la metodología
propuesta. Con ello se evidencia que los modelos entrenados con la metodología propuesta
proporcionan rendimientos similares a los modelos que no hacen uso de la misma, contando con
2 Disponible en: https://github.com/Te-k/malware-classification/blob/master/data.csv 23
la ventaja de eliminar aquellas características redundantes del conjunto de datos.Cabe mencionar
que, el tiempo de entrenamiento de los modelos con cada unos de los algoritmos para poder evaluar
su desempeño y seleccionar al mejor fue de aproximadamente un minuto con diez segundos.
Cyberattacks are one of the main problems that affect companies worldwide. The perpetrators behind the attacks are known as cybercriminals. These take advantage of existing vulnerabilities in computer systems to make the attacks, causing theft of confidential information and economic losses for the affected companies or organizations. That is why an alternative is being sought to reduce this problem, an option to consider is machine learning as a tool to improve computer security. The purpose of this thesis work was to present an intrusion detection model that makes use of the technique proposed in the thesis work itself, which combines the filter and wrapper techniques for the selection of characteristics in the data pre-processing phase. The data set used for the training and testing of the models was obtained from the GitHub3 repository. Classification algorithms were used to train the models. Based on the accuracy metric, the best intrusion detection model was selected, which was trained using the RandomForest algorithm. This model achieved a mean of 99.42% accuracy with the proposed feature selection technique, improving by 0.10% the result of the model trained with the same algorithm but without the use of the proposed methodology. This shows that models trained with the proposed methodology provides similar performance to the models that don't use it, with the advantage of eliminating redundant characteristics from the data set. It's worth mentioning that the training time of the models with 3 Available in: https://github.com/Te-k/malware-classification/blob/master/data.csv 25 each one of the algorithms to be able to evaluate their performance and select the best one was approximately one minute and ten seconds.
Cyberattacks are one of the main problems that affect companies worldwide. The perpetrators behind the attacks are known as cybercriminals. These take advantage of existing vulnerabilities in computer systems to make the attacks, causing theft of confidential information and economic losses for the affected companies or organizations. That is why an alternative is being sought to reduce this problem, an option to consider is machine learning as a tool to improve computer security. The purpose of this thesis work was to present an intrusion detection model that makes use of the technique proposed in the thesis work itself, which combines the filter and wrapper techniques for the selection of characteristics in the data pre-processing phase. The data set used for the training and testing of the models was obtained from the GitHub3 repository. Classification algorithms were used to train the models. Based on the accuracy metric, the best intrusion detection model was selected, which was trained using the RandomForest algorithm. This model achieved a mean of 99.42% accuracy with the proposed feature selection technique, improving by 0.10% the result of the model trained with the same algorithm but without the use of the proposed methodology. This shows that models trained with the proposed methodology provides similar performance to the models that don't use it, with the advantage of eliminating redundant characteristics from the data set. It's worth mentioning that the training time of the models with 3 Available in: https://github.com/Te-k/malware-classification/blob/master/data.csv 25 each one of the algorithms to be able to evaluate their performance and select the best one was approximately one minute and ten seconds.
Descripción
PDF
Palabras clave
Aprendizaje Automático, Ciberataque, Conjunto de datos, Filter, Selección de subconjunto de características, Wrapper, Machine Learning, Cyberattack, Data Set, Filter, Feature Subset Selection, Wrapper