Scan Detection System Using Artificial Neural Networks

摘要

With the growth and expansion of the Internet, the world has become smaller. Nowadays, when it comes to communication, we don't usually think about borders or distances, since we can easily communicate with anyone anywhere in the world, using a cheap resource like an Internet connection. Furthermore, with the growing complexity of information technology infrastructures, like clouds, even when external deterrence is granted, no one can completely assure that information is safe and controlled. In parallel with the enormous flexibility and capacity of the internet, it is necessary to recall that the presence of sensitive data roaming, the Internet or traversing obscure technological layers may lead to attacks targeting critical data or vulnerable network devices, which is the essence of information warfare activities. At the moment, with the dissemination of Social Networks, streaming and other popular internet contents, billions of Terabytes of information are transitioned over the internet. This fact allows that malicious activity roams over the internet, hidden in legitimate look alike traffic. Those activities can only be identified by sophisticated Intrusion Detection Systems (IDS). However, and despite their evolution, due to the huge quantity of events they need to look for, IDSs still produce a great number of false positives, leading to a huge efficiency reduction. The main goal of this work is to demonstrate how a modified IDS (Artificial Neural Networks plus Snort) can be used to reduce false positives generation. In order to achieve our goal, it has been developed a Java application, capable of capture network data, which is processed using artificial neural networks and self-learning methods. Those self-learning methods allow the improvement of the neural network false positive generation rate. We set up this prototype, and monitored, for more than 30 days, a general company network serving several employees. During this time, all anomalies were recorded in a MySQL database for posterior analysis. Our detection results were compared with the ones obtained with a default configured Snort. Throughout this paper we present the reasons why we chose not only this subject but also the Neural Networks technology to implement the solution. We also describe the results obtained and how we made it possible to improve the detection of false positives.