Sodinokibi intrusion detection based on logs clustering and random forest - Université Clermont Auvergne Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

Sodinokibi intrusion detection based on logs clustering and random forest

Kévin Cortial
  • Fonction : Auteur
  • PersonId : 1106837
Arnault Pachot

Résumé

Cyber-attacks are becoming more common and their consequences more and more disastrous. Machine learning is revolutionizing cyber security by analyzing massive amounts of data automatically. In this paper, we test the unsupervised learning method of k-means to detect the intrusion of Sodinokibi ransomware in logs. The k-means highlighted a small cluster of anomalous logs that are revealed to be the entry points of the cyberattack. This positive result allows us to consider automating of k-means, as a solution to monitor logs in real time and report abnormal behavior.

Mots clés

Domaines

Informatique
Fichier principal
Vignette du fichier
icaiis21-8.pdf (909.9 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03312925 , version 1 (03-08-2021)

Identifiants

Citer

Kévin Cortial, Arnault Pachot. Sodinokibi intrusion detection based on logs clustering and random forest. 2021 2nd International Conference on Artificial Intelligence and Information Systems (ICAIIS ’21), May 2021, Chongqing, China. ⟨10.1145/3469213.3469221⟩. ⟨hal-03312925⟩
33 Consultations
99 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More