Avancées en détection d'intrusion réseau : jeux de données, bancs d'essai, explications des alertes et réduction des faux positifs

Intrusion detection systems (IDS) allow to detect cyber attacks and react accordingly.They perform detection either at the network level or at the host level.IDSes have gradually integrated machine learning (ML) to achieve detection.These tools generate too many false alerts, and when they use ML, the alerts can be difficult to understand because of the lack of transparency of certain models.The evaluation of IDSes performance is complex and is carried out from intrusion detection datasets, including some provided by the academic community.Through this thesis work, multiple defects have been identified in existing reference datasets that are used for the development and evaluation of IDSes.The identification and correction of the problems and the assessment of their impact is the first contribution. miniDEDALE: A new intrusion detection dataset was produced by deeply enhancing the SOCBED platform to overcome the identified issues.This is a second contribution.Since 2017, the identified issues in the CICIDS2017 dataset have not been found, which may be due to a lack of transparency in the used IDSes.To overcome this lack, the last contribution is AE-pvalues: a method to explain the alerts raised by IDSes using an Auto-Encoder as an ML model.These explanations allow analysts to quickly identify the abnormal network characteristics and ease the beginning the investigation.Finally, a study is proposed regarding the use of explanations to reduce the number of false alarms automatically.