Praćenje upotrebe računala radi detekcije neovlaštenog korištenja

master's thesis

• Title (english): Monitoring User Behavior on a Computer System to Detect Unauthorized Use
• Author: Belma Gutlić
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Vlado Sruk (član povjerenstva)
• Committee member: Vlado Glavinić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2017-07-11, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Postojeći sigurnosni problemi su većinom bazirani na detekciji prijetnji malicioznih programa koristeći definirani skup uzoraka i pravila. Problem neovlaštenog korištenja računala ne pokriva takav skup pravila i nije moguće deterministički odrediti je li se dogodilo preuzimanje računala ili ne. U ovom radu, predložen je sustav koji identificira korisničke akcije i detektira nepravilnosti u realnom vremenu na osnovu analize ponašanja korisnika. U izgradnji sustava korišten je Osquery alat za dobivanje korisničkih zapisa od Linux operacijskog sustava, a pomoću implementacije strojnog učenja predviđa se korisnikov sljedeći korak nakon kojeg se akcija, na osnovu prethodne predikcije, identificira kao ovlaštena ili neovlaštena.

Abstract (english)

Existing security solutions are mostly based on preventing known malicious threats or a defined set of rules and patterns. But there is a problem in detecting unauthorized used of a computer system which can't be solved with such defined rules and deterministically define if computer system was taken over or not. In this paper, the proposed system is an adaptive user action identifier which can predict and detect anomalous behavior, in real time, based on user and entity behavior analytics (UEBA). In this work, an Osquery framework has been used to acquire user actions logs from Linux operating system and the implementation of machine learning algorithms to predict user's next step and identify next action as malicious or not.

• Keywords: korisničko ponašanje; strojno učenje; neuronska mreža; detekcija anomalija
• Keywords (english): UEBA; machine learning; neural network; anomaly detection
• Language: croatian
• URN:NBN: urn:nbn:hr:168:754628
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2019-03-13 20:44:59