Análisis de tráfico de datos malicioso mediante técnicas machine learning, utilizando OPNids en la red del edifico de la FIE.

Abstract

This research aims to analyze malicious data traffic through the OPNids platform made of a machine learning engine in charge of detecting computer attacks on the Informatics and Electronics Faculty (FIE) network at Escuela Superior Politécnica de Chimborazo (ESPOCH). An analysis of the Faculty's data traffic was carried out to meet the proposed objectives by using the IDS Suricata integrated with OPNids, and the threats and potential computer attacks to which the Faculty's intranet is exposed were detected. A study based on the machine learning theory applied to detecting intrusions with its different classification algorithms was carried out, being Random Forest, an algorithm with high precision characteristics to classify different types of attacks. Next, the algorithm training process was conducted to adjust it to the FIE intranet's needs, taking into account the IDS Suricata analysis threats. Subsequently, the GNS3 simulation based on threats detected was performed in a scenario similar to a faculty laboratory. Finally, the performance and effectiveness of the OPNids platform in detecting intrusion through computer attacks such as DoS, R2L, U2R, and scanning similar to those detected in the data traffic analysis were evaluated in conjunction with the parameters obtained from the machine learning algorithm. As a result, a precision and F1 score of 98% of the machine learning model was obtained. It is recommended to carry out tests with other classification algorithms and check the difference in intrusion detection between them and verify the OPNids platform's support.