Design and implementation of a predictive module for the intrusion detection system snort based on supervised machine learning algorithms

Rubén Jiménez. (2018). Design and implementation of a predictive module for the intrusion detection system snort based on supervised machine learning algorithms. Final Career Project (PFC). Universidad Politécnica de Madrid, ETSI Telecomunicación.

Abstract:
Security on computer networks has become a critical topic for many companies and organizations due the security concerns and costs associated that can have a severe impact. Due to increasing traffic using encryption techniques which on one hand increase security on the other hand it helps attackers to hide their illegitimate activities making harder for defenders to detect and protect its infrastructure. This final project defines a machine learning based approach that can be included in Snort by the addition of rules generated by machine learning algorithms. This flow can be continued over the time with supervision to update detection capabilities of the system. Algorithms C5.0, J48, random forest, generalized boosting method and JRip will be evaluated against the NSL-KDD dataset for a binary scenario (normal or anomaly) and for a multiclass scenario (Dos, probe, R2L, U2R and normal).