Online Machine Learning-enabled Network Intrusion Detection

Machine Learning (ML) is seeing growing usage on Network Intrusion Detection Systems (NIDS) and allowing for an early detection of novel attacks, a prime example of how this technology may be applied to the field of cybersecurity. However, computational requirements associated with ML might make it difficult to process traffic in real time, particularly when dealing with a large volume of data or a high throughput connection, undermining the NIDS' usefulness or its detection capabilities. The goal of this dissertation is to implement an IDS capable of detecting malware command and control traffic over TLS. This system will include: 1) a baseline component which detects and discards blacklisted TLS certificates, 2) a ML component that classifies traffic flows based on a previously created model, and 3) an information storing component allowing for the ML model to be retrained as the TLS certificates' blacklist is updated. The online performance of this detection system will be evaluated against a high traffic volume, with conclusions contributing to Machine Learning-enabled network intrusion detection