{"id":{"repo_id":"brazil-uerj","oai_identifier":"oai:pantheon.ufrj.br:11422/6237"},"canonical_url":"https://search.dev.ndltd.org/etd/brazil-uerj/oai:pantheon.ufrj.br:11422/6237","repository":{"repo_id":"brazil-uerj","name":"Brazil UERJ","base_url":"https://pantheon.ufrj.br/oai/request"},"display":{"title":"A fast and adaptive threat detection and prevention architecture","abstract":"The late detection of security threats causes a significant increase in the risk of irreparable damages, disabling any defense attempt. We propose a fast and adaptive Threat Detection and Prevention Architecture based on stream processing and machine learning algorithms. The proposed architecture combines the adaptability of online trained machine learning algorithms with the efficiency of batch trained methods. We create a dataset by capturing both legitimate and malicious traffic and compare two ways of combining packets into flows, one gathering all packets in a time window and the other analyzing only the first few packets of each flow. Besides our created dataset, we also analyze our proposal on real data composed of fixed-broadband Internet user traffic from one of the major Brazilian network operators. In order to evaluate our detection architecture, we develop five classification algorithms and two anomaly detection methods. In fact, the proposed architecture provides adaptability to new traffic behavior and achieves a high accuracy rate and a good trade-off between attack detection and false positive rate in anomaly detection. We further propose an improved scheme, based on Software Defined Networks, that automatically prevents threats by only analyzing the first few packets of a flow. The proposal promptly and efficiently blocks threats, is robust, and can scale up, even on scenarios in which the attacker employs spoofed IP address. Moreover, we evaluate the scalability, by increasing the number of stream processing cores and allocating more resources to sensor elements. The results shows an accuracy higher than 90% and threat detection time of four microseconds, which promptly enables counter measures.","abstract_html":"The late detection of security threats causes a significant increase in the risk of irreparable damages, disabling any defense attempt. We propose a fast and adaptive Threat Detection and Prevention Architecture based on stream processing and machine learning algorithms. The proposed architecture combines the adaptability of online trained machine learning algorithms with the efficiency of batch trained methods. We create a dataset by capturing both legitimate and malicious traffic and compare two ways of combining packets into flows, one gathering all packets in a time window and the other analyzing only the first few packets of each flow. Besides our created dataset, we also analyze our proposal on real data composed of fixed-broadband Internet user traffic from one of the major Brazilian network operators. In order to evaluate our detection architecture, we develop five classification algorithms and two anomaly detection methods. In fact, the proposed architecture provides adaptability to new traffic behavior and achieves a high accuracy rate and a good trade-off between attack detection and false positive rate in anomaly detection. We further propose an improved scheme, based on Software Defined Networks, that automatically prevents threats by only analyzing the first few packets of a flow. The proposal promptly and efficiently blocks threats, is robust, and can scale up, even on scenarios in which the attacker employs spoofed IP address. Moreover, we evaluate the scalability, by increasing the number of stream processing cores and allocating more resources to sensor elements. The results shows an accuracy higher than 90% and threat detection time of four microseconds, which promptly enables counter measures.","abstract_has_math":false,"creators":["Lobato, Antonio Gonzalez Pastana"],"institution":"Universidade Federal do Rio de Janeiro","degree_name":null,"degree_level":null,"degree_discipline":null,"degree_department":null,"school":null,"contributors":[],"advisors":["Duarte, Otto Carlos Muniz Bandeira"],"committee_chairs":[],"committee_members":[],"year":2017,"date_issued":"2017-12","date_published":"2017-12","updated_at":"2026-07-24T01:16:21Z","subjects":["Algoritmos","Aprendizado computacional","Estabilidade de sistemas"],"languages":["eng"],"rights":["Acesso Aberto"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"http://hdl.handle.net/11422/6237","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Duarte, Otto Carlos Muniz Bandeira"]},{"key":"dc:creator","label":"Author","values":["Lobato, Antonio Gonzalez Pastana"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2019-01-25T16:08:32Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2026-05-16T03:04:20Z"]},{"key":"dc:date.issued","label":"Date","values":["2017-12"]},{"key":"dc:publisher","label":"Institution","values":["Universidade Federal do Rio de Janeiro"]},{"key":"dc:publisher.department","label":"Dc Publisher Department","values":["Instituto Alberto Luiz Coimbra de Pós-Graduação e Pesquisa de Engenharia"]},{"key":"dc:type","label":"Dc Type","values":["Dissertação"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Algoritmos","Aprendizado computacional","Estabilidade de sistemas"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Acesso Aberto"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.uri","label":"Identifier URI","values":["http://hdl.handle.net/11422/6237"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["The late detection of security threats causes a significant increase in the risk of irreparable damages, disabling any defense attempt. We propose a fast and adaptive Threat Detection and Prevention Architecture based on stream processing and machine learning algorithms. The proposed architecture combines the adaptability of online trained machine learning algorithms with the efficiency of batch trained methods. We create a dataset by capturing both legitimate and malicious traffic and compare two ways of combining packets into flows, one gathering all packets in a time window and the other analyzing only the first few packets of each flow. Besides our created dataset, we also analyze our proposal on real data composed of fixed-broadband Internet user traffic from one of the major Brazilian network operators. In order to evaluate our detection architecture, we develop five classification algorithms and two anomaly detection methods. In fact, the proposed architecture provides adaptability to new traffic behavior and achieves a high accuracy rate and a good trade-off between attack detection and false positive rate in anomaly detection. We further propose an improved scheme, based on Software Defined Networks, that automatically prevents threats by only analyzing the first few packets of a flow. The proposal promptly and efficiently blocks threats, is robust, and can scale up, even on scenarios in which the attacker employs spoofed IP address. Moreover, we evaluate the scalability, by increasing the number of stream processing cores and allocating more resources to sensor elements. The results shows an accuracy higher than 90% and threat detection time of four microseconds, which promptly enables counter measures."]},{"key":"dc:title","label":"Title","values":["A fast and adaptive threat detection and prevention architecture"]}]}],"canonical_facts":{"dc:contributor.advisor":["Duarte, Otto Carlos Muniz Bandeira"],"dc:creator":["Lobato, Antonio Gonzalez Pastana"],"dc:date.accessioned":["2019-01-25T16:08:32Z"],"dc:date.available":["2026-05-16T03:04:20Z"],"dc:date.issued":["2017-12"],"dc:description.abstract":["The late detection of security threats causes a significant increase in the risk of irreparable damages, disabling any defense attempt. We propose a fast and adaptive Threat Detection and Prevention Architecture based on stream processing and machine learning algorithms. The proposed architecture combines the adaptability of online trained machine learning algorithms with the efficiency of batch trained methods. We create a dataset by capturing both legitimate and malicious traffic and compare two ways of combining packets into flows, one gathering all packets in a time window and the other analyzing only the first few packets of each flow. Besides our created dataset, we also analyze our proposal on real data composed of fixed-broadband Internet user traffic from one of the major Brazilian network operators. In order to evaluate our detection architecture, we develop five classification algorithms and two anomaly detection methods. In fact, the proposed architecture provides adaptability to new traffic behavior and achieves a high accuracy rate and a good trade-off between attack detection and false positive rate in anomaly detection. We further propose an improved scheme, based on Software Defined Networks, that automatically prevents threats by only analyzing the first few packets of a flow. The proposal promptly and efficiently blocks threats, is robust, and can scale up, even on scenarios in which the attacker employs spoofed IP address. Moreover, we evaluate the scalability, by increasing the number of stream processing cores and allocating more resources to sensor elements. The results shows an accuracy higher than 90% and threat detection time of four microseconds, which promptly enables counter measures."],"dc:identifier.uri":["http://hdl.handle.net/11422/6237"],"dc:language":["eng"],"dc:publisher":["Universidade Federal do Rio de Janeiro"],"dc:publisher.department":["Instituto Alberto Luiz Coimbra de Pós-Graduação e Pesquisa de Engenharia"],"dc:rights":["Acesso Aberto"],"dc:subject":["Algoritmos","Aprendizado computacional","Estabilidade de sistemas"],"dc:title":["A fast and adaptive threat detection and prevention architecture"],"dc:type":["Dissertação"]},"updated_at":"2026-07-24T01:16:21Z"}