Ensembling to improve infected hosts detection

• Autores: Venosa, Paula; García, Sebastián; Díaz, Francisco Javier
• Año de publicación: 2019
• Idioma: inglés
• Tipo de recurso: documento de conferencia
• Materia: Ciencias Informáticas; Ensemble leaming; Cybersecurity; Malware / spyware crime; Intrusion detection systems
• Institución: Universidad Nacional de La Plata

In this paper we describe the main ensemble learning techniques and their application in the cybersecurity threats detection. The state of the art in the use of ensemble learning techniques is presented here as an alternative to the current intrusion detection mechanisms, analyzing their advantages and disadvantages. We propose to incorporate ensemble learning to SLIPS [3], a behavioral-based intrusion detection and prevention system that uses machine learning algorithms to detect malicious behaviors, to obtain better results, taking advantage of the benefits of the SLIPS classifiers and modules. As part of this work we extend ensembling by considering algorithms from different domains (not machine learning domains), as Thread Intelligence. As a first stage of this project, performance tests of ensemble learning algorithms were performed to detect malware from flows evaluating its accuracy. The results of these tests are presented here, as well as the conclusions obtained and the future work.
VIII Workshop Seguridad informática.
Red de Universidades con Carreras en Informática