Detecção de Anomalias em Redes de Computadores e o uso de Wavelets

Abstract

Attacks on computer networks compromise the security of the system and degrade the performance of the network causing problems to users and organizations. Network-based Intrusion Detection Systems are used to detect attacks or malicious activity by analyzing the network traffic. The anomaly-based detection approach is used for intrusion detection. It is assumed that the presence of traffic anomalies, deviations from standard behavior, is indicative of an attack or malfunction. A major difficulty of an anomaly-based Intrusion Detection System is the construction of the profile due to the complexity of network traffic. Methods derived from Signal Analysis, among which, the Wavelet Transform, have recently demonstrated applicability in detecting anomalies in network. This paper presents the basic concepts of intrusion detection and recent concepts related to intrusion detection by wavelet transforms, a multiresolution analysis technique with low computational complexity.