Electronic Thesis and Dissertation Repository

Degree

Master of Engineering Science

Program

Electrical and Computer Engineering

Supervisor

Samarabandu Jagath

2nd Supervisor

Wang Xianbin

Co-Supervisor

Abstract

There are new challenges in network security, introduced by the nature of modern networks like IoT systems, Cloud systems, and other distributed systems. System resource limitations in IoT, delays in processing the large stream of data from Cloud and distributed system, incapability to handle multi-step attacks due to delay in updates, limited datasets used for Intrusion Detection System (IDS) training which impacts the system performance are some of the pressing issues. To address these challenges, the author proposes Intelligent Network Security Systems, a framework that can handle these issues and also be as accurate as a commercial grade IDS. The proposed framework consists of three components: a Dataset Creation Software (DCS), an Intrusion Detection System and a Learning module. This thesis presents implementation details and validation results for DCS and IDS.

The first component is a highly customizable software framework capable of generating labeled network intrusion datasets on demand. This software is able to collect data from a live network as well as from a pre-recorded packet capture file. The output can be either Raw packet capture (PCAP) with selected attributes per packet or a processed dataset with customized attributes related to both individual packet features and overall traffic behavior within a time window. The abilities of this component are compared with a state-of-the-art dataset creation system through a feature comparison.

The proposed Intrusion Detection System is a novel, distributed IDS that is able to perform in real-time in a distributed system. Hierarchical decision making is used to reduce traffic overhead on the IDS and allow faster Intrusion Detection. The IDS also detects multi-step attacks faster by updating the system rules when a reconnaissance attack is detected, without any human intervention. Internal attacks are also detected easily because of the distributed nature of the IDS. The performance tests show that the IDS performs 8 times faster on averages with the hierarchical decision-making structure and still maintains the same level of accuracy as Snort.

Download

Share

COinS