Análisis de amenazas de seguridad basado en la detección de anomalías en el tráfico de red de la infraestructura tecnológica de instituciones de educación superior mediante el uso de técnicas de machine learning

Abstract

Communications networks have undergone unprecedented developments, mainly due to a significant increase in data traffic. This makes the issue of the security of technological infrastructures an important point to be addressed within the scope of Higher Education Institutions. These types of institutions handle large amounts of data, which imply an increase in network traffic; therefore, the anomalies or vulnerabilities number’s have been progressively increasing. These security attacks involve threats to the confidentiality, integrity and/or availability of the data handled. However, there are tools such as ML algorithms, which allow pre-detection of such events. The present experimental work carries out the framework’s implementation that allows anomalies’ detection in the Higher Education Institutions network’s traffic applying ML techniques, specifically in the UNACH case. To do this, a collection of events corresponding to a time lapse was analyzed through the ELK stack; subjected to data’s preprocessing stages, storage and visualization for the analysis. Through the application of the K-Means algorithm, developed through Python’s Scikit-Learn library and Weka software, a total of three experiments were performed on the collected events. This allowed the detection of potential threats or anomalies, which will be presented and corroborated using dashboards developed in Kibana. Through the implementation of this framework, the clusterization algorithms’ utility was verified as an optimal tool for the anomalies’ detection within a university network. Obtaining anomalous behaviors within the network such as interference, channel overlaps, authentication of unidentified users or identification of unauthorized AP.