Uma Comparação entre os Sistemas de Detecção de Ameaças Distribuídas de Rede Baseado no Processamento de Dados em Fluxo e em Lotes

Abstract

With the advancement of technology, allowing a greater massification of devices connected to the Internet of Things, there is a huge increase in the communication that circulates through the network, resulting in a growing number of vulnerability exploitations detected every year. Thus, faster and more accurate systems are needed to efficiently detect distributed denial of service attacks and port scans. This paper proposes a system for on-line detection of distributed network threats using data stream processing. The results obtained by the proposed system are compared with the results obtained by a system using batch processing, both operating on the same database, widely known by the scientific community. The proposed system is evaluated through two metrics: accuracy and number of false-positive and false-negative. The results show that using data stream processing improved detection accuracy by up to 17,50%, reducing the number of false-positives and false-negatives by up to 66,61%.