Practical Operating Method for Intrusion Detection System Using Machine Learning and Visualization

• Material Type: 博士論文
• Title: Practical Operating Method for Intrusion Detection System Using Machine Learning and Visualization
• Author/Editor: 木村, 知史
• Author Heading: 木村, 知史
• Publication Date: 2021-03-25
• Publication Date (W3CDTF): 2021-03-25
• Alternative Title: 機械学習及び視覚化を用いた実用的なIDSの運用手法
• Degree grantor/type: 京都工芸繊維大学
• Date Granted: 2021-03-25
• Dissertation Number: 甲第996号
• Degree Type: 博士（工学）
• Text Language Code: eng
• Subject Heading: Intrusion Detection System; Information Security; Network Security; Anomaly Detection; Machine Learning; Deep Learning; Visualization; Domain Name System
• Target Audience: 一般
• Note (General): type:Thesis; Detecting cyber-attacks plays a crucial role in the modern network society. Intrusion Detection System (IDS) monitors a network activity consisting many protocols, and reports several alerts to an administrator when some anomaly alerts are caused. After receiving the alerts, the administrator can perform more detailed investigation to identify anomalies. However, IDS generates a large number of alerts. Although many researches to reduce a large number of alerts have been actively studied, developing the practical and useful operation for IDS is expected.In this thesis, we explore the practical operating method for IDS by using machine learning and visualization approaches. We found that many IDS alerts have three features : (1) Steady, (2) Periodicity, (3) Sudden mass detection. Utilizing these features, we first developed the visualization system emphasizing the anomaly alerts using past tendency, which allows the administrator to intuitively identify the network status and anomaly alerts. In addition, we developed the method for forecasting the alerts with high accuracy using the periodicity, which enables the administrator to identify the future trend of IDS alerts without analyzing the logs manually. Furthermore, we developed the method for forecasting Domain Name System (DNS) packets and detecting DNS attacks to identify the cause of anomaly at early stage with IDS alerts. These proposed methods that can be adopted to IDS alerts and DNS packets allow the administrator to identify the network status and the anomaly without analyzing the logs manually, in which we will greatly contribute to promote practical operating for IDS.
• Access Restrictions: インターネット公開
• Data Provider (Database): 国立情報学研究所 : 学術機関リポジトリデータベース（IRDB）（機関リポジトリ）; https://irdb.nii.ac.jp
• Original Data Provider (Database): 京都工芸繊維大学 : ＫＩＴ学術成果コレクション

Table of Contents

http://repository.lib.kit.ac.jp/repo/repository/10212/2636/D1-0996_h1.pdf fulltext

http://repository.lib.kit.ac.jp/repo/repository/10212/2636/D1-0996.pdf fulltext