Intrusion detection using machine learning
A method comprises collecting network data associated with data transmission in a computing environment. The method also comprises identifying, using one or more machine learning models, at least one intrusion type affecting the computing environment. The identification of the at least one intrusion type is based at least in part on the collected network data. In the method, one or more remedial communications addressing the at least one intrusion type are generated, and the one or more remedial communications are transmitted to a user.
1. An apparatus comprising:
at least one processing platform comprising at least one processing device comprising a processor coupled to a memory;
said at least one processing platform being configured:
to collect network data associated with data transmission in a computing environment;
to identify, using one or more machine learning models, at least one intrusion type affecting the computing environment, wherein the identification of the at least one intrusion type is based at least in part on the collected network data, and wherein, in identifying the at least one intrusion type affecting the computing environment, said at least one processing platform is configured:
to input at least a portion of the collected network data to a first autoencoder, wherein the first autoencoder reduces dimensions of the portion of the collected network data from a first number of features to a second number of features and generates a first output based on the reduced dimensions; and
to input the first output based on the reduced dimensions to a second autoencoder, wherein the second autoencoder further reduces the dimensions of the portion of the collected network data from the second number of features to a third number of features and generates a second output based on the further reduced dimensions;
to generate one or more remedial communications addressing the at least one intrusion type; and
to transmit the one or more remedial communications to a user;
wherein the at least one intrusion type comprises an attack on at least a portion of the computing environment; and
wherein the one or more machine learning models are trained at least in part with training data indicating an absence of intrusions.
2. The apparatus of claim 1 wherein said at least one processing platform is configured to perform the identification of the at least one intrusion type and the generation of the one or more remedial communications as a real-time response to the collection of the network data.
3. The apparatus of claim 1 wherein the collected network data comprises at least one of connection data, traffic data and content data.
4. The apparatus of claim 3 wherein the collected network data further comprises one or more indications of at least one of protocol type, service type and one or more connection status flags.
5. The apparatus of claim 1 wherein, in collecting the network data, said at least one processing platform is configured to intercept one or more data packets comprising metadata corresponding to a live data transmission.
6. The apparatus of claim 1 wherein the one or more remedial communications comprise at least one of a name of the at least one intrusion type, a class of the at least one intrusion type and network location information associated with the at least one intrusion type.
7. The apparatus of claim 1 wherein the one or more remedial communications comprise one or more mitigation measures to at least one of curtail and prevent the at least one intrusion type.
8. The apparatus of claim 1 wherein the training data further comprises at least one of connection data, traffic data and content data.
9. The apparatus of claim 8 wherein said at least one processing platform is configured to reduce dimensions of the training data.
10. The apparatus of claim 8 wherein the training data further indicates identified intrusion types, and wherein the identified intrusion types and the absence of intrusions correspond to respective groupings of at least one of the connection data, the traffic data and the content data.
11. The apparatus of claim 1 wherein the at least one processing platform is further configured to input to the one or more machine learning models at designated intervals updated training data indicating the absence of intrusions.
12. The apparatus of claim 1 wherein the first output comprises the second number of features and the second output comprises the third number of features.
13. The apparatus of claim 12 wherein, in identifying the at least one intrusion type affecting the computing environment, said at least one processing platform is further configured to input the third number of features to a multiclass logistic classifier, the multiclass logistic classifier classifying the third number of features into the at least one intrusion type.
14. The apparatus of claim 13 wherein the at least one intrusion type comprises one of a denial of service (DOS) attack, a user to root (U2R) attack, a root to local (R2L) attack and a probing attack.
15. A method comprising:
collecting network data associated with data transmission in a computing environment;
identifying, using one or more machine learning models, at least one intrusion type affecting the computing environment, wherein the identification of the at least one intrusion type is based at least in part on the collected network data, and wherein identifying the at least one intrusion type affecting the computing environment comprises:
inputting at least a portion of the collected network data to a first autoencoder, wherein the first autoencoder reduces dimensions of the portion of the collected network data from a first number of features to a second number of features and generates a first output based on the reduced dimensions; and
inputting the first output based on the reduced dimensions to a second autoencoder, wherein the second autoencoder further reduces the dimensions of the portion of the collected network data from the second number of features to a third number of features and generates a second output based on the further reduced dimensions;
generating one or more remedial communications addressing the at least one intrusion type; and
transmitting the one or more remedial communications to a user;
wherein the at least one intrusion type comprises an attack on at least a portion of the computing environment;
wherein the one or more machine learning models are trained at least in part with training data indicating an absence of intrusions; and
wherein the method is performed by at least one processing platform comprising at least one processing device comprising a processor coupled to a memory.
16. The method of claim 15 further comprising inputting to the one or more machine learning models at designated intervals updated training data indicating the absence of intrusions.
17. The method of claim 15 wherein the first output comprises the second number of features and the second output comprises the third number of features.
18. The method of claim 17 wherein identifying the at least one intrusion type affecting the computing environment further comprises inputting the third number of features to a multiclass logistic classifier, the multiclass logistic classifier classifying the third number of features into the at least one intrusion type.
19. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing platform causes said at least one processing platform:
to collect network data associated with data transmission in a computing environment;
to identify, using one or more machine learning models, at least one intrusion type affecting the computing environment, wherein the identification of the at least one intrusion type is based at least in part on the collected network data, and wherein, in identifying the at least one intrusion type affecting the computing environment, the program code further causes said at least one processing platform:
to input at least a portion of the collected network data to a first autoencoder, wherein the first autoencoder reduces dimensions of the portion of the collected network data from a first number of features to a second number of features and generates a first output based on the reduced dimensions; and
to input the first output based on the reduced dimensions to a second autoencoder, wherein the second autoencoder further reduces the dimensions of the portion of the collected network data from the second number of features to a third number of features and generates a second output based on the further reduced dimensions;
to generate one or more remedial communications addressing the at least one intrusion type; and
to transmit the one or more remedial communications to a user;
wherein the at least one intrusion type comprises an attack on at least a portion of the computing environment; and
wherein the one or more machine learning models are trained at least in part with training data indicating an absence of intrusions.
20. The computer program product according to claim 19 wherein the first output comprises the second number of features and the second output comprises the third number of features.