Event Details
Performance Analysis of a Graph-based Anomaly Detector and the Zeek Intrusion Detection System
Presenter: Somayeh Roshandel
Supervisor:
Date: Wed, May 4, 2022
Time: 10:00:00 - 11:00:00
Place: via Zoom - please see link below
ABSTRACT
Zoom Link: https://uvic.zoom.us/j/88523337787?pwd=NUVSZWQwS0VaQnNXT2ZIY01rMU9TZz09
Meeting ID: 885 2333 7787
Password: 388193
One tap mobile
+17789072071,,88523337787# Canada
+16475580588,,88523337787# Canada
Dial by your location
+1 778 907 2071 Canada
+1 647 558 0588 Canada
Meeting ID: 885 2333 7787
Find your local number: https://uvic.zoom.us/u/kcJhFRB4xp
Note: Please log in to Zoom via sso and your UVic Netlink ID.
Abstract:
Due to the increase in the number of cyber security attacks and malicious behaviours, different sectors of society are required to mitigate the risk of being targeted by threat actors. Network Intrusion Detection Systems (NIDS) have become an essential part of most security strategies deployed in organizations as a protection layer for their network infrastructure. In this project, we analyze the performance of a graph-based unsupervised anomaly detection model that was developed at the Information Security and Object Technology (ISOT) Lab. The performance evaluation was conducted using a large public IDS evaluation dataset called CICIDS2017. This allowed confirming the performance results obtained in the original model evaluation that was conducted using a different dataset. Furthermore, by running the Zeek intrusion detection system (IDS) on the CICIDS2017 we were able to compare and contrast the graph-based anomaly detector against Zeek.