Användning av statistiska modeller för att upptäcka samtidiga fler-stegsattacker

This thesis focuses on two simultaneous brute-force password cracking and DDoS attack scenarios: In scenario A, the flows of the two attackers can be analyzed separately based on their IP addresses. However, in scenario B, due to IP spoofing, IP addresses become unreliable, so the mixed attack sequences should be analyzed directly. Conventional intrusion detection systems (IDS) are inadequate for these sophisticated attacks, prompting the need for advanced methods. This thesis studies a novel approach that integrates statistical models into IDS. The method contains two main steps: data source selection (feature selection) and model learning. Four feature sets are selected by different feature selection methods. These selected features are then utilized in statistical models including Hidden Markov Model (HMM) and Long Short- Term Memory (LSTM) model, and can speed up the model learning. This combination aims to predict the start time of the attack and confirm the attack type in both scenarios, enabling a timely response to simultaneous multi- step attacks. Experimental evaluations demonstrate that the models achieve high accuracy in predicting attack start times and steps, with a very low misclassification rate for attack types on the investigated dataset. This method significantly enhances the capability of IDS to handle complex, multi-step, and simultaneous attacks, ensuring better network security.