Graph-based Feature Enrichment for Online Intrusion Detection in Virtual Networks
Igor Jochem Sanz, Otto Carlos M. B. Duarte · 2019
The ubiquitousness of Internet-of-Things devices paves the way for distributed network attacks at an unprecedented scale. Graph theory, strengthened by machine learning techniques, improves an automatic discovery of group behavior patterns of distributed network threats often omitted by traditional security systems. This dissertation proposes an intrusion detection system for online threat detection enriched by a graph-learning analysis. We develop a feature enrichment algorithm that infers metrics based on a graph analysis. By using different machine learning techniques, we evaluated our system for three network traffic datasets. Results show that the proposed enrichment improves the threat detection accuracy up to 15.7% and significantly reduces false-positive rate. Furthermore, we evaluate intrusion detection systems deployed as virtual network functions and propose SFCPerf, a framework for automating performance evaluation of service function chaining. To demonstrate SFCPerf functionality, we evaluate different NFV scenarios, including a real security service function chain prototype, composed of our intrusion detection system and a firewall.