Contribuições ao estudo de sistemas de detecção de intrusão em hosts para ataques de dia zero

Abstract

In the context of the ubiquitous use of digital media and data in contemporary society, cybersecurity emerges as one of the most critical areas. In this context, computer intrusion detection systems emerge as an essential tool for ensuring the security of digital data and media. This work aimed to evaluate the performance of LSTM, Transformer, and Kohonen Map (SOM) techniques in identifying zero-day attacks on hosts. The evaluated models were employed within the unsupervised classification paradigm, which does not use labels for classes in the training process. The unsupervised paradigm is capable of identifying new attacks and minimizing the reduced availability of attack data in the face of the immense amount of data originating from normal host operations. The performance measures adopted were intrusion detection rate, false alarm rate, number of parameters, and number of floating-point operations of the adopted models, in order to evaluate not only the final effectiveness of each model but also to consider its computational complexities. It was demonstrated that the technique that presented the best performance was the Transformer with an AUC (Area Under the Curve) of 0.990, however, the SOM presented lower computational complexity with an intermediate AUC.