Sodinokibi intrusion detection based on logs clustering and random forest
Résumé
Cyber-attacks are becoming more common and their consequences more and more disastrous. Machine learning is revolutionizing cyber security by analyzing massive amounts of data automatically. In this paper, we test the unsupervised learning method of k-means to detect the intrusion of Sodinokibi ransomware in logs. The k-means highlighted a small cluster of anomalous logs that are revealed to be the entry points of the cyberattack. This positive result allows us to consider automating of k-means, as a solution to monitor logs in real time and report abnormal behavior.
Domaines
Informatique
Origine : Fichiers produits par l'(les) auteur(s)