Skip to Main content Skip to Navigation
Conference papers

An Adaptive Real-Time Architecture for Zero-Day Threat Detection

Abstract : Attackers create new threats and constantly change their behavior to mislead security systems. In this paper, we propose an adaptive threat detection architecture that trains its detection models in real time. The major contributions of the proposed architecture are: i) gather data about zero-day attacks and attacker behavior using honeypots in the network; ii) process data in real time and achieve high processing throughput through detection schemes implemented with stream processing technology; iii) use of two real datasets to evaluate our detection schemes, the first from a major network operator in Brazil and the other created in our lab; iv) design and development of adaptive detection schemes including both online trained supervised classification schemes that update their parameters in real time and learn zero-day threats from the honeypots, and online trained unsupervised anomaly detection schemes that model legitimate user behavior and adapt to changes. The performance evaluation results show that proposed architecture maintains an excellent trade-off between threat detection and false positive rates and achieves high classification accuracy of more than 90%, even with legitimate behavior changes and zero-day threats.
Document type :
Conference papers
Complete list of metadata

https://hal.sorbonne-universite.fr/hal-02099022
Contributor : Guy Pujolle <>
Submitted on : Saturday, April 13, 2019 - 7:25:19 PM
Last modification on : Tuesday, March 23, 2021 - 9:28:02 AM

Identifiers

Citation

Antonio Gonzalez Pastana Lobato, Martin Andreoni Lopez, Igor Jochem Sanz, Alvaro Cardenas, Otto Carlos M. B. Duarte, et al.. An Adaptive Real-Time Architecture for Zero-Day Threat Detection. 2018 IEEE International Conference on Communications (ICC 2018), May 2018, Kansas City, United States. pp.1-6, ⟨10.1109/ICC.2018.8422622⟩. ⟨hal-02099022⟩

Share

Metrics

Record views

95