An intelligent behavior-based intrusion detection method for virtual machines

In recent years, the speed and complexity of computer networks have grown significantly.At the same time, network-based anomalies and attacks have increased.Nowadays, intrusion detection and prevention is considered as a main strategy in satisfying the security of computer systems and communication networks, and the detection of these attacks with high accuracy and the least error is very important, especially in the field of network management.Today, virtualization technology is widely developing in order to set up multiple virtual systems on a physical system.Computational clouds are the most hallmark of this technology.Intrusion detection systems play a key role in protecting cloud resources on virtual machines.An intrusion detection system has the task of monitoring events within a computer system and the communication networks, and detects unauthorized and abnormal behaviors to deal with them.The proposed systems for intrusion detection mainly use data mining, machine learning and statistical analysis of data.Therefore, it is natural that in some cases they lead to the production of false alarms.Consequently, it is essential to improve the accuracy and high detection capability of these systems.Regarding the increasing speed and complexity of these machines, it is necessary to increase the ability and accuracy of intrusion detection systems for identifying different types of attacks at a right time.In this regard, the ‫سال‬ 1400 ‫شمارة‬ 2 ‫پیاپی‬ 48 136 use of behavior-based approaches has attracted more attention due to their high scalability in the large networks.The methods for intrusion detection that utilize network traffic graph clustering do not have the accuracy and appropriateness with the speed of data transfer in the current computer networks.Thus, the solutions can be improved by choosing an appropriate strategy for clustering.In this paper, a new behavior-based method for detecting intrusion in computer networks is presented.To this end, the network data was modeled through the flow of data as a traffic dispersion graph and then clustered using an improved Markov-based algorithm.Then, by analyzing a set of statistical criteria, the produced clusters, a penetration detection model was constructed.A set of modified statistical criteria was defined and utilized for analyzing the constructed clusters.The proposed model was examined and evaluated on the DARPA 99 dataset.In addition, the results of the proposed method were compared with seven other methods which work based on machine learning techniques.The results show that in the proposed method, the error detection rate is significantly reduced and the accuracy rate of the method is increased compared to seven other intrusion detection approaches.The reason for this performance improvement can be attributed to the good performance of Markov's improved clustering algorithm, which has produced more accurate results on flow-based data.Also, defining and applying appropriate criteria to determine the threshold limits is effective in obtaining accurate results.In addition, the results demonstrate that the proposed model has better capabilities than the methods which are not use graph clustering and can detect attacks with high accuracy.