Aplicación de GHSOM (Growing Hierarchical Self-Organizing Maps) a sistemas de detección de intrusos (IDS)

  1. De la Hoz Correa, Eduardo Miguel 1
  2. Ortiz, Andrés 2
  3. Ortega, Julio 3
  1. 1 Corporación Universidad de la Costa - CUC. Barranquilla, Colombia
  2. 2 Universidad de Málaga. Madrid, España
  3. 3 Universidad de Granada. Granada, España
Mostrar afiliaciones +
Revista:
INGE CUC

ISSN: 0122-6517,  2382-4700

Año de publicación: 2012

Volumen: 8

Número: 1

Páginas: 117-148

Tipo: Artículo

DIALNET GOOGLE SCHOLAR lock_openDialnet editor

Otras publicaciones en: INGE CUC

Resumen

Con el pasar de los años, en el ámbito de la seguridad informática el problema de la intrusión se desarrolla cada día más, incrementando la existencia de programas que buscan afectar a computadoras tanto a nivel local como a toda una red informática. Esta dinámica lleva a entender los ataques y la mejor manera de contrarrestarlos, ya sea previniéndolos o detectándolos a tiempo, procurando que su impacto sea menor al esperado por el atacante. En este artículo se presenta una revisión de los ataques a sistemas informáticos, ahondando en los Sistemas de Detección de Intrusos (IDS) y en la implementación de técnicas de agrupamiento de datos —como las redes neuronales—, con el fin de encontrar métodos con altas precisiones en la detección de anomalías. Esta propuesta presenta la aplicación de GHSOM en IDS, utilizando el conjunto de datos NSL-KDD, y mostrando las mejoras encontradas en la detección de ataques en el proceso de búsqueda.

Referencias bibliográficas

  • Referencias [1] Real Academia Española, Diccionario de la Lengua Española. [Online] Disponible en: http://lema.rae.es/drae/?val=seguridad
  • [2] Real Academia Española, Diccionario de la Lengua Española. [Online] Disponible en: http://lema.rae.es/drae/?val=seguro
  • [3] Real Academia Española, Diccionario de la Lengua Española: [Online] Disponible en: http://lema.rae.es/drae/?val=informat%C3%ADca
  • [4] Asociación de Técnicos de Informática - ATI. Glosario básico inglés-español para usuarios de Internet, [Online] Disponible en: http://www.ati.es/novatica/glosario/glosario_internet.txt
  • [5] A. Villalón Huerta, Seguridad en Unix y redes. [Online] Disponible en: http://www.rediris.es/cert/doc/unixsec/unixsec.pdf, pp. 6-7. 2002.
  • [6] R. Heady, G. Luger, A. Maccabe and M. Servilla, The Architecture of a Network Level Intrusion Detection System. Technical report, Department of Computer Science, University of New Mexico, August 1990.
  • [7] Fyodor, Network Mapping Tool [Online]. Disponible en: http://www.insecure.org/nmap
  • [8] Institute for Internet Security [Online]. Disponible en: http://www.internet-sicherheit.de/en/research/recent-projects/internet-early-warning-systems/internetanalysis-system/recent-results/
  • [9] Guo, Fanglu, Jiawu Chen and Tzi cker Chiueh: Spoof Detection for Preventing DoSv Attacks against DNS Servers. In: 26th IEEE International Conference, pp. 37-39. 2006.
  • [10] S. Kumar, Classification and Detection of Computer Intrusions. Tesis de Doctorado, Purdue University, 1995, citeseer.ist.psu.edu/kumar95classification.html
  • [11] ComputerWire, DDoS Really, Really Tested UltraDNS. Informe técnico, [Online]. Disponible en: http://www.theregister.co.uk/2002/12/14/ddos_attack_really_really_tested/ attack really really tested, December 2002.
  • [12] T. Olovsson, A Structured Approach to Computer Security. Informe técnico, Chalmers University of Technology, pp. 37-73. 1992.
  • [13] A. Villalón Huerta, Seguridad en Unix y redes. [Online] Disponible en: http://www.rediris.es/cert/doc/unixsec/unixsec.pdf, pp. 11 - 12. 2002.
  • [14] B. Daniel, OSSEC. [Online]. Disponible en: www.ossec.net, 2006.
  • [15] Ch. Hosmer and M. Duren, “Detecting Subtle System Changes Using Digital Signatures”. En Information Technology Conference, IEEE. Laboratory at Purdue University, pp. 125-128, 1998.
  • [16] M. Roesch, Lightweight Intrusion Detection for Networks. [Online]. Disponible en: http://www.snort.org, 2005.
  • [17] O. Dain and R. Cunningham, Fusing Heterogeneous Alert Streams into Scenarios. Massachusetts Institute of Technology, September 2001. citeseer.ist.psu.edu/dain-01fusing.html
  • [18] L. Girardin, “An Eye on Network Intruderadministrator Shootouts”. En Proceedings of the Workshop on Intrusion Detection and Network Monitoring (ID’99), Berkeley, CA, USA, 1999. USENIX Association. citeseer.ist.psu.edu/girardin99eye.html. pp. 19-28.
  • [19] A. Siraj, R. B. Vaughn and S. M. Bridges, “Intrusion Sensor Data Fusion in an Intelligent Intrusion Detection System Architecture”. En Proceedings of the 37th Annual Hawaii International Conference, p. 10, 2004.
  • [20] S. X. Wu and W. Banzhaf, “The use of computational intelligence in intrusion detection systems: A review”. Applied Soft Computing, 10(1), 1-35. doi: 10.1016/j.asoc.2009.06.019. 2010.
  • [21] H. Debar, M. Dacier and A. Wespi, “A revised taxonomy for intrusion-detection systems”. IBM Research Technical Report, October 1999.
  • [22] S. Axelsson, Intrusion Detection Systems: A Taxonomy and Survey. Technical Report 99-15, Dept. of Computer Engineering, Chalmers University of Technology, Goteborg, Sweden. 2000.
  • [23] Networks, Enterasys, Intrusion Detection Methodologies Demystified. [Online]. Disponible en: http://www.enterasys.com/products/ids/whitepapers/, 2005. Ver también: S. Northcutt, Inside Network Perimeter Security: An Analyst Handbook. Ed. New Riders edición, 2003. pp. 125- 127. Ver también: R. Bace, ICSA: An Introduction to Intrusion Detection and Assessment. [Online]. Disponible en: http://www.icsalabs.com/html/communities/ids/whitepaper/Intrusion1.pdf, 2005.
  • [24] S. Kumar and E. H. Spafford, “Software Architecture to Support Misuse Intrusion Detection”. En Proceedings of the 18th National Information Security Conference, pp. 194-204. 1995.
  • [25] S. Watanabe, Pattern recognition: human and mechanical. John Wiley & Sons, Inc., New York, NY, USA. 1985.
  • [26] A. K. Jain, M. Ñ. Murty and P. J. Flynn, “Data clustering: a review”. ACM Computing Surveys, 31(3). pp. 264-323, 1999.
  • [27] A. K. Jain, M. Ñ. Murty and P. J. Flynn, “Data clustering: a review”. ACM Computing Surveys, 31(3). p. 30, 1999.
  • [28] R. C. Dubes, Cluster analysis and related issues. 1993.
  • [29] A. K. Jain and R. C. Dubes, Algorithms for clustering data. Prentice-Hall, Inc., Upper Saddle River, NJ, USA. 1988.
  • [30] A. K. Jain, M. Ñ. Murty and P. J. Flynn, “Data clustering: a review”. ACM Computing Surveys, 31(3). p. 278, 1999.
  • [31] J. J. Hopfield, “Neural networks and physical systems with emergent properties”,Proceedingns of the National Academy of Sciences 79. pp. 2554-2558, 1982.
  • [32] T. Kohonen, “Self-organized formation of topologically correct feature maps”. Biological Cybernetics, 43. pp. 59-69, 1982.
  • [33] G. A. Carpenter and S. Grossberg, “The art of adaptive pattern recognition by a self-organizing neural network”. Computer, 21(3). pp. 77-78, 1988.
  • [34] M. Dittenbach, D. Merkl and A. Rauber, “The Growing Hierarchical Self-Organizing Map”. In S: Amari, C. L. Giles, M. Gori and V. Puri (editors), Proc of the International Joint Conference on Neural Networks (IJCNN 2000), volume VI, Como, Italy. IEEE Computer Society. pp. 15-19, 2000.
  • [35] B. Fritzke, “A growing neural gas network learns topologies”. In G. Tesauro, D. S. Touretzky and T. K. Leen (editors), Advances in Neural Information Processing Systems 7. MIT Press, Cambridge MA. pp. 625-632, 1995.
  • [36] J. Blackmore and R. Miikkulainen, “Incremental grid growing: Encoding highdimensional structure into a two-dimensional feature map”. In Proceedings of the International Conference on Neural Networks ICNN93, volume I. Piscataway, NJ. IEEE Service Center. pp. 450-455, 1993.
  • [37] D. Alahakoon, S. K. Halgamuge and B. Srinivasan, “A structure adapting feature map for optimal cluster representation”. In International Conference on Neural Information Processing ICONIP98. pp. 809- 812, 1998.
  • [38] A. Ocsa, C. Bedregal and E. Cuadros-Vargas, “DB-GNG: A constructive self-organizing map based on density”. In Proceedings of the International Joint Conference on Neural Networks (IJCNN07). IEEE, 2007.
  • [39] A. K. Jain, J. Mao and K. M. Mohiuddin, Artificial neural networks: A tutorial. IEEE Computer, 29(3):31-44, 1996.
  • [40] T. Kohonen, Self-Organizing Maps, 3ra Edición, Springer-Verlag, p. 86, 2001.
  • [41] T. Kohonen, Self-Organizing Maps, 3ra Edición, Springer-Verlag, 2001.
  • [42] T. Kohonen, “The Self-Organizing Maps”. Proceedings of the IEE, Vol. 78, No. 9, September 1990, p. 1467.
  • [43] T. Kohonen, Self-Organizing Maps. Springer, Berlin, 1995.
  • [44] Imagen disponible en Internet: http://www.peltarion.com/doc/images/SOM_Unified_distance_matrix.gif
  • [45] M. Dittenbach, D. Merkl and A. Rauber, “The Growing Hierarchical Self-Organizing Map”. In S. Amari, C. L. Giles, M. Gori and V. Puri, (editors), Proc of the International Joint Conference on Neural Networks (IJCNN 2000), volume VI, Como, Italy. IEEE Computer Society. pp. 199-216, 2000.
  • [46] S. P. Luttrell, “Hierarchical self-organizing networks”. In Proceedings of the International Conference on Neural Networks (ICANN’89). London, U.K. pp. 2-6, 1989.
  • [47] G. R. Zargar and P. Kabiri, “Selection of Effective Network Parameters in Attacks for Intrussion Detection”. In: IEEE International Conference on Data Mining. 2010.
  • [48] E. J. Palomo, E. Domínguez, R. M. Luque And J. Muñoz, “Network security using growing hierarchical self-organizing maps”. In: M. Kolehmainen, P. Toivanen, and B. Beliczynski (eds.) ICANNGA 2009. LNCS, vol. 5495. Springer, Heidelberg. pp. 130-139, 2009.
  • [49] R. Datti and B. Verma, “Feature Reduction for Intrusion Detection Using Linear Discriminant Analysis”. International Journal on Engineering Science and Technology 2(4). pp. 1072-1078, 2010.
  • [50] S. Mukkamala and A. H. Sung, “Feature Ranking and Selection for Intrusion Detection Systems Using Support Vector Machines”. In: Proceedings of the Second Digital Forensic Research Workshop. 2002.
  • [51] A. Ortiz, J. Ortega, A. Martínez and A. Prieto, “Intrusion detection and prevention by using Hierarchical Selforganizing Maps and Multiobjective-based feature selection”. International Journal on Neural System. pp. 232-239, 2011.
Fuente de los datos: Dialnet