Detecting Complex Intrusion Attempts Using Hybrid Machine Learning Techniques رسالة ماجستير

Abstract

Organizations are in a constant race to secure their services and infrastructure from ever-evolving information security threats. The primary security control of the arsenal is the Intrusion Detection System (IDS), which can automatically detect attacks and intrusion attempts. For the IDS to be effective, it needs to detect all kinds of attacks while not disturbing legitimate traffic by erroneously classifying them as attacks and affecting normal operations. Additionally, IDS needs to detect previously unknown attacks that do not exist in its knowledge base. This capability is traditionally achieved by anomaly detection based on trends and baselines; an approach that is prone to high false-positive rates. This dissertation will explore the most appropriate machine learning algorithms and techniques, specifically hybrid machine learning. This hybrid approach will combine unsupervised and supervised machine learning to detect previously unknown attacks while minimizing false positives by analyzing events generated by different connected systems and devices.