
Application of Bioinformatics Algorithms for 3RO\PRUSKLF Cyberattacks Detection
Author(s) -
Maxim Kalinin,
Dmitry P. Zegzhda,
Vasiliy Krundyshev,
Daria S. Lavrova,
Dmitry A. Moskvin,
E. Yu. Pavlenko
Publication year - 2021
Publication title -
informatika i avtomatizaciâ/informatika i avtomatizaciâ (print)
Language(s) - English
Resource type - Journals
eISSN - 2713-3206
pISSN - 2713-3192
DOI - 10.15622/ia.20.4.3
Subject(s) - intrusion detection system , computer science , anomaly based intrusion detection system , algorithm , data mining , set (abstract data type) , signature (topology) , mathematics , geometry , programming language
The functionality of any system can be represented as a set of commands that lead to a change in the state of the system. The intrusion detection problem for signature-based intrusion detection systems is equivalent to matching the sequences of operational commands executed by the protected system to known attack signatures. Various mutations in attack vectors (including replacing commands with equivalent ones, rearranging the commands and their blocks, adding garbage and empty commands into the sequence) reduce the effectiveness and accuracy of the intrusion detection. The article analyzes the existing solutions in the field of bioinformatics and considers their applicability for solving the problem of identifying polymorphic attacks by signature-based intrusion detection systems. A new approach to the detection of polymorphic attacks based on the suffix tree technology applied in the assembly and verification of the similarity of genomic sequences is discussed. The use of bioinformatics technology allows us to achieve high accuracy of intrusion detection at the level of modern intrusion detection systems (more than 0.90), while surpassing them in terms of cost-effectiveness of storage resources, speed and readiness to changes in attack vectors. To improve the accuracy indicators, a number of modifications of the developed algorithm have been carried out, as a result of which the accuracy of detecting attacks increased by up to 0.95 with the level of mutations in the sequence up to 10%. The developed approach can be used for intrusion detection both in conventional computer networks and in modern reconfigurable network infrastructures with limited resources (Internet of Things, networks of cyber-physical objects, wireless sensor networks).