Uso de algoritmo de aprendizagem de máquina não-supervisionado para prevenção da formação de redes botnet

Abstract

The Internet of Things has become more important due to its applicability to many embedded systems ecosystems in daily use. However, those systems’ devices have several hardware constraints and neglected security. Consequently, botnets malwares have taken advantage of poor security schemas on such devices. This dissertation evaluates the use of four unsupervised machine learning algorithms using data streams to detect botnet formation on the network edge. The algorithms were chosen after a literature review for being less demanding, being more adequate to implement in more restricted environments. To increase the efficiency and quality of results, two processing algorithms were also used. It was used a dataset generated by nine smart objects and with two infection variants: Mirai and Bashlite. Qualitative experiments were made to assess the classification results of each algorithm and also to evaluate the results after varying processing and memory resources changes to verify a minimal configuration to a device properly execute the algorithms. After qualitative and performance evaluations, the results showed that algorithms such as BIRCH, DenStream, and DStream are viable choices to detect malicious data that are sent in botnet formation. Those algorithms have an average accuracy between 96% and 98%, needing few samples per device and sample analysis response time of 300 milliseconds in a Raspberry Pi Zero W, being a constrained device and much similar to an application in an Internet of Things scenario.