Artificial Intelligence for Security Attacks Detection

In recent years, there has been an explosion in cybersecurity attacks. As countermeasures are implemented, new variants of attacks appear in the meantime. Historically, Intrusion Detection Systems (IDS) have been typically employed to detect cyberattacks or anomalous behaviour in networks. Nowadays, two types of IDS exist: signature-based and anomaly-based. The first type of IDS is typically effective only against attacks that have been discovered and for which a signature exists, which is saved in dedicated databases across the globe. The second type of IDS is highly required nowadays because it can detect attacks without registered signatures using Machine Learning and Deep Learning techniques. Such IDS perform traffic analysis, exploiting data of different levels and alerts if a suspicious pattern is encountered. This thesis focus on the exploitation of Artificial Intelligence (AI) for security attack detection for IDS anomaly-based. The thesis analyses several AI algorithms and proposes an innovative model that is able to detect new attacks. Different datasets, which contain nine different attacks, are used in this work. The Balanced Accuracy, the Receiver Operating Characteristics (ROC) and the Area Under ROC Curve (AUC) resulting from the proposed method are calculated and compared with the supervised models, such as Random Forest and Extreme Gradient Boosting. The proposed model shows higher balanced accuracy and AUC results to detect unknown attacks than the supervised models. This work demonstrates the effectiveness of the proposed Auto-Encoder model in detecting the unknown attack, mainly to detect Heartbleed attacks.