Uma arquitetura para a detecção de intrusos no ambiente wireless usando redes neurais artificiais

Abstract

Most of the existing software of wireless intrusion detection identify behaviors obtrusive only taking as a basis the exploitation of known vulnerabilities commonly called of attack signatures. They analyze the activity of the system, watching sets of events that are similar to a pre-determined pattern that describes an intrusion known. Thus, only known vulnerabilities are detected, leading to the need for new techniques for detecting intrusions be constantly added to the system. It is necessary to implement a wireless IDS that can identify intrusive behaviors also based on the observation of the deflection normal behaviour of the users, hosts or network connections. This normal behaviour should be based on historical data, collected over a long period of normal operation. This present work proposes an architecture for a system to intrusion detection in wireless networks by anomalies, which is based on the application of technology to artificial neural networks, both in the processes of intrusion detection, as making countermeasures. The system can be adapted to the profile of a new community of users, and can recognize attacks with characteristics somewhat different from the already known by the system, relying only on deviations in behaviour of this new community. A prototype has been implemented and various simulations and tests were performed on it, with three denial of service attacks. The tests were to verify the effectiveness of the application of neural networks in the solution of the problem of wireless network intrusion detection, and concentrated its focus on the power of generalization of neural networks. This ensures the system detects attacks though these features slightly different from those already known.