{"id":1806,"date":"2023-04-19T17:21:18","date_gmt":"2023-04-19T15:21:18","guid":{"rendered":"https:\/\/dtstc.ugr.es\/neus-cslab\/?page_id=1806"},"modified":"2023-04-20T09:21:11","modified_gmt":"2023-04-20T07:21:11","slug":"ids","status":"publish","type":"page","link":"https:\/\/dtstc.ugr.es\/neus-cslab\/lineas-de-investigacion\/ids\/","title":{"rendered":"Detecci\u00f3n de intrusiones"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"1806\" class=\"elementor elementor-1806\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e4e972e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e4e972e\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2d2bf1a\" data-id=\"2d2bf1a\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-af31eea elementor-widget elementor-widget-heading\" data-id=\"af31eea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Detecci\u00f3n de intrusiones<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8f6ac55 elementor-widget__width-initial elementor-widget elementor-widget-text-editor\" data-id=\"8f6ac55\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p style=\"text-align: justify; text-indent: 20pt; line-height: 150%; font-family: 'Lato',serif; font-style: normal; font-weight: 300; justify-content: align; font-size: 100%;\"><img fetchpriority=\"high\" decoding=\"async\" class=\"alignleft\" src=\"\/neus-cslab\/wp-content\/uploads\/2023\/04\/siem-300x221.jpg\" alt=\"\" width=\"291\" height=\"193\" \/>\nLos Sistemas de Detecci\u00f3n de Intrusos (IDS) son herramientas de seguridad que, al igual que\notras medidas como software antivirus, cortafuegos y\u00a0esquemas de control de acceso, est\u00e1n destinados a fortalecer la seguridad de los sistemas de informaci\u00f3n y comunicaci\u00f3n.\u00a0<span style=\"font-family: Lato, serif; font-style: normal; font-weight: 300; text-indent: 20pt;\">Con la aparici\u00f3n continua de nuevos tipos de ataques, que se desarrollan de forma flexible y adaptable,\u00a0 l<\/span><span style=\"font-family: Lato, serif; font-style: normal; font-weight: 300; text-indent: 20pt;\">as t\u00e9cnicas de detecci\u00f3n de intrusos son una tecnolog\u00eda valiosa para proteger los sistemas de destino y\u00a0<\/span><span style=\"font-family: Lato, serif; font-style: normal; font-weight: 300; text-indent: 20pt;\">redes contra actividades maliciosas.<\/span><\/p>\n<p style=\"text-align: justify; text-indent: 20pt; line-height: 150%; font-family: 'Lato',serif; font-style: normal; font-weight: 300; justify-content: align; font-size: 100%;\">En la actualidad, los IDS se integran como elementos clave en los sistemas de monitorizaci\u00f3n de la seguridad (NSM), cuya finalidad es proporcionar consciencia situacional a los operadores. Para ello a\u00f1aden funcionalidades relacionadas con la integraci\u00f3n de informaci\u00f3n sobre el estado de la red y los sistemas y la correlaci\u00f3n de eventos, fundamentalmente alertas de los IDS.<\/p>\n<p style=\"text-align: justify; text-indent: 20pt; line-height: 150%; font-family: 'Lato',serif; font-style: normal; font-weight: 300; justify-content: align; font-size: 100%;\">Nuestro grupo dispone de <strong>amplia experiencia en los sistemas de detecci\u00f3n de intrusiones<\/strong>, especialmente en el contexto de los servicios web.\u00a0 El foco de nuestra investigaci\u00f3n est\u00e1 actualmente en mejorar la calidad de la informaci\u00f3n generada por los NSM a partir de la <strong>mejora de las prestaciones<\/strong> de los IDS y la <strong>correlaci\u00f3n <\/strong>de las alertas generadas tanto entre s\u00ed como con informaci\u00f3n procedente de sensores de monitorizaci\u00f3n de tr\u00e1fico.<\/p>\n<p style=\"text-align: justify; text-indent: 20pt; line-height: 150%; font-family: 'Lato',serif; font-style: normal; font-weight: 300; justify-content: align; font-size: 100%;\">Esta l\u00ednea de investigaci\u00f3n sirve de <strong>soporte a <\/strong>las dos l\u00edneas principales: seguridad en web y seguridad en IoT.<\/p>\n<p style=\"text-align: justify; text-indent: 20pt; line-height: 150%; font-family: 'Lato',serif; font-style: normal; font-weight: 300; justify-content: align; font-size: 100%;\"><span style=\"font-family: Lato, serif; font-style: normal; font-weight: 300; text-indent: 20pt;\">Destacan en esta l\u00ednea el desarrollo de t\u00e9cnicas novedosas de <\/span><strong style=\"font-family: Lato, serif; font-style: normal; text-indent: 20pt;\">detecci\u00f3n basadas en anomal\u00edas<\/strong><span style=\"font-family: Lato, serif; font-style: normal; font-weight: 300; text-indent: 20pt;\"> y en <\/span><strong style=\"font-family: Lato, serif; font-style: normal; text-indent: 20pt;\">metodolog\u00edas<\/strong><span style=\"font-family: Lato, serif; font-style: normal; font-weight: 300; text-indent: 20pt;\"> y herramientas <\/span><strong style=\"font-family: Lato, serif; font-style: normal; text-indent: 20pt;\">para la evaluaci\u00f3n<\/strong><span style=\"font-family: Lato, serif; font-style: normal; font-weight: 300; text-indent: 20pt;\"> de sistemas de detecci\u00f3n. Una de las herramientas b\u00e1sicas utilizadas es el modelado de Markov, que, en el caso de protocolos basados en mensajes de texto, permite establecer un aut\u00f3mata de estados finitos probabil\u00edstico (FSA) que puede utilizarse para modelar dichos mensajes y, consecuentemente, evaluar su normalidad o anormalidad.<\/span><\/p>\n<img decoding=\"async\" class=\"aligncenter\" src=\"\/neus-cslab\/wp-content\/uploads\/2023\/04\/fsa-http-300x201.png\" alt=\"\" width=\"300\" height=\"201\" \/>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-1223443 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1223443\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-e913e57\" data-id=\"e913e57\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-af28f5d elementor-widget elementor-widget-text-editor\" data-id=\"af28f5d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #0a3824;\">L\u00edneas de trabajo<\/span><\/h3><ul><li><p style=\"text-align: justify; line-height: normal;\">Desarrollo de <strong>sistemas de detecci\u00f3n de intrusiones<\/strong> basados en <strong>anomal\u00edas<\/strong> (AIDS)<\/p><\/li><li><p style=\"text-align: justify; line-height: normal;\"><strong>Evaluaci\u00f3n<\/strong> de sistemas de detecci\u00f3n de intrusiones basada en <strong>firmas<\/strong> (SIDS)<\/p><\/li><li><p style=\"text-align: justify; line-height: normal;\"><strong style=\"font-size: 17px;\">Metodolog\u00edas de evaluaci\u00f3n<\/strong><span style=\"font-size: 17px;\"> de sistemas de detecci\u00f3n de intrusiones<\/span><\/p><\/li><li><p style=\"text-align: justify; line-height: normal;\">Generaci\u00f3n<strong> autom\u00e1tica de firmas <\/strong>para SIDS<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-c249292\" data-id=\"c249292\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-9b7e90b elementor-widget elementor-widget-text-editor\" data-id=\"9b7e90b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #0a3824;\">T\u00e9cnicas \/ m\u00e9todos\n<\/span><\/h3>\n<ul>\n \t<li>\n<p style=\"text-align: justify; line-height: normal;\">Modelado de Markov<\/p>\n<\/li>\n \t<li>\n<p style=\"text-align: justify; line-height: normal;\">An\u00e1lisis de cadenas<\/p>\n<\/li>\n \t<li>\n<p style=\"text-align: justify; line-height: normal;\">Aprendizaje autom\u00e1tico<\/p>\n<\/li>\n \t<li>\n<p style=\"text-align: justify; line-height: normal;\">An\u00e1lisis de series temporales<\/p>\n<\/li>\n \t<li><p style=\"text-align: justify; line-height: normal;\">Comparaci\u00f3n de patrones<\/li>\n \t<li><p style=\"text-align: justify; line-height: normal;\">Correlaci\u00f3n de eventos<\/li>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-5eb5f14 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5eb5f14\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-33 elementor-inner-column elementor-element elementor-element-d769f74\" data-id=\"d769f74\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-33 elementor-inner-column elementor-element elementor-element-613982e\" data-id=\"613982e\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-90b0b64 elementor-widget elementor-widget-text-editor\" data-id=\"90b0b64\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #0a3824;\">Resultados relevantes<br \/><\/span><\/h3><ul><li><p style=\"text-align: justify; line-height: normal;\">Sistema de detecci\u00f3n de anomal\u00edas para HTTP<\/p><\/li><li><p style=\"text-align: justify; line-height: normal;\">Prototipo de sistema de generaci\u00f3n autom\u00e1tica de firmas para HTTP<\/p><\/li><li>Inspectorlog: detecci\u00f3n de ataques basada en firmas sobre trazas HTTP<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-33 elementor-inner-column elementor-element elementor-element-c7a4a36\" data-id=\"c7a4a36\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a78e8af elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a78e8af\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-a051be7\" data-id=\"a051be7\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-81abaea elementor-widget elementor-widget-heading\" data-id=\"81abaea\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Publicaciones destacadas<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a7c28d6 elementor-widget__width-initial elementor-widget elementor-widget-text-editor\" data-id=\"a7c28d6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><div class=\"teachpress_pub_list\"><form name=\"tppublistform\" method=\"get\"><a name=\"tppubs\" id=\"tppubs\"><\/a><\/form><div class=\"teachpress_publication_list\"><div class=\"tp_publication tp_publication_article\"><div class=\"tp_pub_info\"><p class=\"tp_pub_author\"> Walabonso Lara, Agust\u00edn;  Mayor, Vicente;  Estepa Alonso, Rafael;  Estepa Alonso, Antonio;  D\u00edaz-Verdejo, Jes\u00fas E.<\/p><p class=\"tp_pub_title\"><a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('265','tp_links')\" style=\"cursor:pointer;\">Smart home anomaly-based IDS: Architecture proposal and case study<\/a> <span class=\"tp_pub_type tp_  article\">Art\u00edculo de revista<\/span> <\/p><p class=\"tp_pub_additional\"><span class=\"tp_pub_additional_in\">En: <\/span><span class=\"tp_pub_additional_journal\">Internet of Things, <\/span><span class=\"tp_pub_additional_volume\">vol. 22, <\/span><span class=\"tp_pub_additional_pages\">pp. 100773, <\/span><span class=\"tp_pub_additional_year\">2023<\/span>, <span class=\"tp_pub_additional_issn\">ISSN: 2542-6605<\/span>.<\/p><p class=\"tp_pub_menu\"><span class=\"tp_abstract_link\"><a id=\"tp_abstract_sh_265\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('265','tp_abstract')\" title=\"Mostrar resumen\" style=\"cursor:pointer;\">Resumen<\/a><\/span> | <span class=\"tp_resource_link\"><a id=\"tp_links_sh_265\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('265','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_265\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('265','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_265\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@article{Lara2023,<br \/>\r\ntitle = {Smart home anomaly-based IDS: Architecture proposal and case study},<br \/>\r\nauthor = { {Walabonso Lara}, Agust\u00edn and Vicente Mayor and {Estepa Alonso}, Rafael and {Estepa Alonso} , Antonio and Jes\u00fas E. {D\u00edaz-Verdejo}},<br \/>\r\nurl = {https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2542660523000963},<br \/>\r\ndoi = {10.1016\/J.IOT.2023.100773},<br \/>\r\nissn = {2542-6605},<br \/>\r\nyear  = {2023},<br \/>\r\ndate = {2023-07-01},<br \/>\r\nurldate = {2023-07-01},<br \/>\r\njournal = {Internet of Things},<br \/>\r\nvolume = {22},<br \/>\r\npages = {100773},<br \/>\r\npublisher = {Elsevier},<br \/>\r\nabstract = {The complexity and diversity of the technologies involved in the Internet of Things (IoT) challenge the generalization of security solutions based on anomaly detection, which should fit the particularities of each context and deployment and allow for performance comparison. In this work, we provide a flexible architecture based on building blocks suited for detecting anomalies in the network traffic and the application-layer data exchanged by IoT devices in the context of Smart Home. Following this architecture, we have defined a particular Intrusion Detector System (IDS) for a case study that uses a public dataset with the electrical consumption of 21 home devices over one year. In particular, we have defined ten Indicators of Compromise (IoC) to detect network attacks and two anomaly detectors to detect false command or data injection attacks. We have also included a signature-based IDS (Snort) to extend the detection range to known attacks. We have reproduced eight network attacks (e.g., DoS, scanning) and four False Command or Data Injection attacks to test our IDS performance. The results show that all attacks were successfully detected by our IoCs and anomaly detectors with a false positive rate lower than 0.3%. Signature detection was able to detect only 4 out of 12 attacks. Our architecture and the IDS developed can be a reference for developing future IDS suited to different contexts or use cases. Given that we use a public dataset, our contribution can also serve as a baseline for comparison with new techniques that improve detection performance.},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {article}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('265','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_abstract\" id=\"tp_abstract_265\" style=\"display:none;\"><div class=\"tp_abstract_entry\">The complexity and diversity of the technologies involved in the Internet of Things (IoT) challenge the generalization of security solutions based on anomaly detection, which should fit the particularities of each context and deployment and allow for performance comparison. In this work, we provide a flexible architecture based on building blocks suited for detecting anomalies in the network traffic and the application-layer data exchanged by IoT devices in the context of Smart Home. Following this architecture, we have defined a particular Intrusion Detector System (IDS) for a case study that uses a public dataset with the electrical consumption of 21 home devices over one year. In particular, we have defined ten Indicators of Compromise (IoC) to detect network attacks and two anomaly detectors to detect false command or data injection attacks. We have also included a signature-based IDS (Snort) to extend the detection range to known attacks. We have reproduced eight network attacks (e.g., DoS, scanning) and four False Command or Data Injection attacks to test our IDS performance. The results show that all attacks were successfully detected by our IoCs and anomaly detectors with a false positive rate lower than 0.3%. Signature detection was able to detect only 4 out of 12 attacks. Our architecture and the IDS developed can be a reference for developing future IDS suited to different contexts or use cases. Given that we use a public dataset, our contribution can also serve as a baseline for comparison with new techniques that improve detection performance.<\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('265','tp_abstract')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_265\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"fas fa-globe\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2542660523000963\" title=\"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2542660523000963\" target=\"_blank\">https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2542660523000963<\/a><\/li><li><i class=\"ai ai-doi\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/dx.doi.org\/10.1016\/J.IOT.2023.100773\" title=\"DOI de seguimiento:10.1016\/J.IOT.2023.100773\" target=\"_blank\">doi:10.1016\/J.IOT.2023.100773<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('265','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><div class=\"tp_publication tp_publication_inproceedings\"><div class=\"tp_pub_info\"><p class=\"tp_pub_author\"> Fern\u00e1ndez, Elvira Castillo;  D\u00edaz-Verdejo, Jes\u00fas E.;  Estepa Alonso, Rafael;  Estepa Alonso, Antonio;  Mu\u00f1oz-Calle, Javier;  Madinabeitia, Germ\u00e1n<\/p><p class=\"tp_pub_title\"><a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('477','tp_links')\" style=\"cursor:pointer;\">Multistep Cyberattacks Detection using a Flexible Multilevel System for Alerts and Events Correlation<\/a> <span class=\"tp_pub_type tp_  inproceedings\">Proceedings Article<\/span> <\/p><p class=\"tp_pub_additional\"><span class=\"tp_pub_additional_in\">En: <\/span><span class=\"tp_pub_additional_booktitle\">Proc. European Interdisciplinary Cybersecurity Conference (EICC 2023), <\/span><span class=\"tp_pub_additional_pages\">pp. 6, <\/span><span class=\"tp_pub_additional_year\">2023<\/span>.<\/p><p class=\"tp_pub_menu\"><span class=\"tp_abstract_link\"><a id=\"tp_abstract_sh_477\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('477','tp_abstract')\" title=\"Mostrar resumen\" style=\"cursor:pointer;\">Resumen<\/a><\/span> | <span class=\"tp_resource_link\"><a id=\"tp_links_sh_477\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('477','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_477\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('477','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_477\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@inproceedings{eicc23-attacks,<br \/>\r\ntitle = {Multistep Cyberattacks Detection using a Flexible Multilevel System for Alerts and Events Correlation},<br \/>\r\nauthor = {Elvira {Castillo Fern\u00e1ndez} and Jes\u00fas E. {D\u00edaz-Verdejo} and {Estepa Alonso}, Rafael and {Estepa Alonso}, Antonio and Javier {Mu\u00f1oz-Calle} and Germ\u00e1n Madinabeitia},<br \/>\r\ndoi = {10.1145\/3590777.3590778},<br \/>\r\nyear  = {2023},<br \/>\r\ndate = {2023-06-14},<br \/>\r\nurldate = {2023-06-14},<br \/>\r\nbooktitle = {Proc. European Interdisciplinary Cybersecurity Conference (EICC 2023)},<br \/>\r\npages = {6},<br \/>\r\nabstract = {Current network monitoring systems tend to generate several alerts per attack, especially in multistep attacks. However, Cybersecurity Officers (CSO) would rather receive a single alert summarizing the entire incident. Triggering a single alert per attack is a challenge that requires developing and evaluating advanced event correlation techniques and models to determine the relationships between the different observed events\/alerts.<br \/>\r\n<br \/>\r\nIn this work, we propose a flexible architecture oriented toward the correlation and aggregation of events and alerts in a multilevel iterative approach. <br \/>\r\nIn our scheme, sensors generate events and alerts that are stored in a non-relational database queried by modules that create knowledge structured as meta-alerts that are also stored in the database. These meta-alerts (also called hyperalerts) are, in turn, used iteratively to create new knowledge. This iterative approach can be used to aggregate information at multiple levels or steps in complex attack models. <br \/>\r\nOur architecture also allows the incorporation of additional sensors and the evaluation of various correlation techniques and multistage attack models. The capabilities of the system are assessed through three case studies.},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {inproceedings}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('477','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_abstract\" id=\"tp_abstract_477\" style=\"display:none;\"><div class=\"tp_abstract_entry\">Current network monitoring systems tend to generate several alerts per attack, especially in multistep attacks. However, Cybersecurity Officers (CSO) would rather receive a single alert summarizing the entire incident. Triggering a single alert per attack is a challenge that requires developing and evaluating advanced event correlation techniques and models to determine the relationships between the different observed events\/alerts.<br \/>\r\n<br \/>\r\nIn this work, we propose a flexible architecture oriented toward the correlation and aggregation of events and alerts in a multilevel iterative approach. <br \/>\r\nIn our scheme, sensors generate events and alerts that are stored in a non-relational database queried by modules that create knowledge structured as meta-alerts that are also stored in the database. These meta-alerts (also called hyperalerts) are, in turn, used iteratively to create new knowledge. This iterative approach can be used to aggregate information at multiple levels or steps in complex attack models. <br \/>\r\nOur architecture also allows the incorporation of additional sensors and the evaluation of various correlation techniques and multistage attack models. The capabilities of the system are assessed through three case studies.<\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('477','tp_abstract')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_477\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"ai ai-doi\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/dx.doi.org\/10.1145\/3590777.3590778\" title=\"DOI de seguimiento:10.1145\/3590777.3590778\" target=\"_blank\">doi:10.1145\/3590777.3590778<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('477','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><div class=\"tp_publication tp_publication_article\"><div class=\"tp_pub_info\"><p class=\"tp_pub_author\"> D\u00edaz-Verdejo, J. E.;  Mu\u00f1oz-Calle, F. J.;  Estepa Alonso, A.;  Estepa Alonso, R.;  Madinabeitia, G.<\/p><p class=\"tp_pub_title\"><a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('263','tp_links')\" style=\"cursor:pointer;\">On the Detection Capabilities of Signature-Based Intrusion Detection Systems in the Context of Web Attacks<\/a> <span class=\"tp_pub_type tp_  article\">Art\u00edculo de revista<\/span> <\/p><p class=\"tp_pub_additional\"><span class=\"tp_pub_additional_in\">En: <\/span><span class=\"tp_pub_additional_journal\">Applied Sciences, <\/span><span class=\"tp_pub_additional_volume\">vol. 12, <\/span><span class=\"tp_pub_additional_number\">no 2, <\/span><span class=\"tp_pub_additional_pages\">pp. 852, <\/span><span class=\"tp_pub_additional_year\">2022<\/span>, <span class=\"tp_pub_additional_issn\">ISSN: 20763417<\/span>.<\/p><p class=\"tp_pub_menu\"><span class=\"tp_abstract_link\"><a id=\"tp_abstract_sh_263\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('263','tp_abstract')\" title=\"Mostrar resumen\" style=\"cursor:pointer;\">Resumen<\/a><\/span> | <span class=\"tp_resource_link\"><a id=\"tp_links_sh_263\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('263','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_263\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('263','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_263\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@article{Diaz-Verdejo2022,<br \/>\r\ntitle = {On the Detection Capabilities of Signature-Based Intrusion Detection Systems in the Context of Web Attacks},<br \/>\r\nauthor = {J. E. D\u00edaz-Verdejo and F. J. Mu\u00f1oz-Calle and {Estepa Alonso}, A. and {Estepa Alonso}, R. and G. Madinabeitia},<br \/>\r\nurl = {https:\/\/www.mdpi.com\/2076-3417\/12\/2\/852\/htm https:\/\/www.mdpi.com\/2076-3417\/12\/2\/852},<br \/>\r\ndoi = {10.3390\/app12020852},<br \/>\r\nissn = {20763417},<br \/>\r\nyear  = {2022},<br \/>\r\ndate = {2022-01-01},<br \/>\r\nurldate = {2022-01-01},<br \/>\r\njournal = {Applied Sciences},<br \/>\r\nvolume = {12},<br \/>\r\nnumber = {2},<br \/>\r\npages = {852},<br \/>\r\npublisher = {Multidisciplinary Digital Publishing Institute},<br \/>\r\nabstract = {Signature-based Intrusion Detection Systems (SIDS) play a crucial role within the arsenal of security components of most organizations. They can find traces of known attacks in the network traffic or host events for which patterns or signatures have been pre-established. SIDS include standard packages of detection rulesets, but only those rules suited to the operational environment should be activated for optimal performance. However, some organizations might skip this tuning process and instead activate default off-the-shelf rulesets without understanding its implications and trade-offs. In this work, we help gain insight into the consequences of using predefined rulesets in the performance of SIDS. We experimentally explore the performance of three SIDS in the context of web attacks. In particular, we gauge the detection rate obtained with predefined subsets of rules for Snort, ModSecurity and Nemesida using seven attack datasets. We also determine the precision and rate of alert generated by each detector in a real-life case using a large trace from a public webserver. Results show that the maximum detection rate achieved by the SIDS under test is insufficient to protect systems effectively and is lower than expected for known attacks. Our results also indicate that the choice of predefined settings activated on each detector strongly influences its detection capability and false alarm rate. Snort and ModSecurity scored either a very poor detection rate (activating the less-sensitive predefined ruleset) or a very poor precision (activating the full ruleset). We also found that using various SIDS for a cooperative decision can improve the precision or the detection rate, but not both. Consequently, it is necessary to reflect upon the role of these open-source SIDS with default configurations as core elements for protection in the context of web attacks. Finally, we provide an efficient method for systematically determining which rules deactivate from a ruleset to significantly reduce the false alarm rate for a target operational environment. We tested our approach using Snort&rsquo;s ruleset in our real-life trace, increasing the precision from 0.015 to 1 in less than 16 h of work.},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {article}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('263','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_abstract\" id=\"tp_abstract_263\" style=\"display:none;\"><div class=\"tp_abstract_entry\">Signature-based Intrusion Detection Systems (SIDS) play a crucial role within the arsenal of security components of most organizations. They can find traces of known attacks in the network traffic or host events for which patterns or signatures have been pre-established. SIDS include standard packages of detection rulesets, but only those rules suited to the operational environment should be activated for optimal performance. However, some organizations might skip this tuning process and instead activate default off-the-shelf rulesets without understanding its implications and trade-offs. In this work, we help gain insight into the consequences of using predefined rulesets in the performance of SIDS. We experimentally explore the performance of three SIDS in the context of web attacks. In particular, we gauge the detection rate obtained with predefined subsets of rules for Snort, ModSecurity and Nemesida using seven attack datasets. We also determine the precision and rate of alert generated by each detector in a real-life case using a large trace from a public webserver. Results show that the maximum detection rate achieved by the SIDS under test is insufficient to protect systems effectively and is lower than expected for known attacks. Our results also indicate that the choice of predefined settings activated on each detector strongly influences its detection capability and false alarm rate. Snort and ModSecurity scored either a very poor detection rate (activating the less-sensitive predefined ruleset) or a very poor precision (activating the full ruleset). We also found that using various SIDS for a cooperative decision can improve the precision or the detection rate, but not both. Consequently, it is necessary to reflect upon the role of these open-source SIDS with default configurations as core elements for protection in the context of web attacks. Finally, we provide an efficient method for systematically determining which rules deactivate from a ruleset to significantly reduce the false alarm rate for a target operational environment. We tested our approach using Snort&amp;rsquo;s ruleset in our real-life trace, increasing the precision from 0.015 to 1 in less than 16 h of work.<\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('263','tp_abstract')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_263\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"fas fa-globe\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/www.mdpi.com\/2076-3417\/12\/2\/852\/htm https:\/\/www.mdpi.com\/2076-3417\/12\/2\/852\" title=\"https:\/\/www.mdpi.com\/2076-3417\/12\/2\/852\/htm https:\/\/www.mdpi.com\/2076-3417\/12\/2\/[...]\" target=\"_blank\">https:\/\/www.mdpi.com\/2076-3417\/12\/2\/852\/htm https:\/\/www.mdpi.com\/2076-3417\/12\/2\/[&#8230;]<\/a><\/li><li><i class=\"ai ai-doi\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/dx.doi.org\/10.3390\/app12020852\" title=\"DOI de seguimiento:10.3390\/app12020852\" target=\"_blank\">doi:10.3390\/app12020852<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('263','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><div class=\"tp_publication tp_publication_inproceedings\"><div class=\"tp_pub_info\"><p class=\"tp_pub_author\"> Estepa, Rafael;  Estepa, Antonio;  D\u00edaz-Verdejo, Jes\u00fas;  Lara, Agust\u00edn W;  Madinabeitia, Germ\u00e1n;  S\u00e1nchez, Jos\u00e9 A. Morales<\/p><p class=\"tp_pub_title\"><a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('271','tp_links')\" style=\"cursor:pointer;\">Dise\u00f1o de un IDS basado en anomal\u00edas para IoT: caso de estudio en SmartCities<\/a> <span class=\"tp_pub_type tp_  inproceedings\">Proceedings Article<\/span> <\/p><p class=\"tp_pub_additional\"><span class=\"tp_pub_additional_in\">En: <\/span><span class=\"tp_pub_additional_booktitle\">Actas de las VI Jornadas Nacionales de Investigaci\u00f3n en Ciberseguridad, <\/span><span class=\"tp_pub_additional_pages\">pp. 135\u2013138, <\/span><span class=\"tp_pub_additional_year\">2021<\/span>.<\/p><p class=\"tp_pub_menu\"><span class=\"tp_abstract_link\"><a id=\"tp_abstract_sh_271\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('271','tp_abstract')\" title=\"Mostrar resumen\" style=\"cursor:pointer;\">Resumen<\/a><\/span> | <span class=\"tp_resource_link\"><a id=\"tp_links_sh_271\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('271','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_271\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('271','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_271\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@inproceedings{Estepa-jnic2021,<br \/>\r\ntitle = {Dise\u00f1o de un IDS basado en anomal\u00edas para IoT: caso de estudio en SmartCities},<br \/>\r\nauthor = {Rafael Estepa and Antonio Estepa and Jes\u00fas D\u00edaz-Verdejo and Agust\u00edn W Lara and Germ\u00e1n Madinabeitia and Jos\u00e9 A. Morales S\u00e1nchez},<br \/>\r\nurl = {https:\/\/ruidera.uclm.es\/xmlui\/handle\/10578\/28638},<br \/>\r\ndoi = {10.18239\/jornadas_2021.34.30},<br \/>\r\nyear  = {2021},<br \/>\r\ndate = {2021-01-01},<br \/>\r\nurldate = {2021-01-01},<br \/>\r\nbooktitle = {Actas de las VI Jornadas Nacionales de Investigaci\u00f3n en Ciberseguridad},<br \/>\r\npages = {135--138},<br \/>\r\nabstract = {Los sistemas de Smart-City constituyen un campo espec\u00edfico en el IoT. Las soluciones de ciberseguridad IT tradicionales son excesivamente gen\u00e9ricas y poco eficientes para este tipo de instalaciones con escasos recursos computacionales y de coste limitado. Por ello, en conjunci\u00f3n con una empresa del sector, se est\u00e1 desarrollando un proyecto para la detecci\u00f3n de incidentes de seguridad de un sistema de Iluminaci\u00f3n Inteligente. En este art\u00edculo se describen los resultados iniciales del proyecto.},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {inproceedings}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('271','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_abstract\" id=\"tp_abstract_271\" style=\"display:none;\"><div class=\"tp_abstract_entry\">Los sistemas de Smart-City constituyen un campo espec\u00edfico en el IoT. Las soluciones de ciberseguridad IT tradicionales son excesivamente gen\u00e9ricas y poco eficientes para este tipo de instalaciones con escasos recursos computacionales y de coste limitado. Por ello, en conjunci\u00f3n con una empresa del sector, se est\u00e1 desarrollando un proyecto para la detecci\u00f3n de incidentes de seguridad de un sistema de Iluminaci\u00f3n Inteligente. En este art\u00edculo se describen los resultados iniciales del proyecto.<\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('271','tp_abstract')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_271\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"fas fa-globe\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/ruidera.uclm.es\/xmlui\/handle\/10578\/28638\" title=\"https:\/\/ruidera.uclm.es\/xmlui\/handle\/10578\/28638\" target=\"_blank\">https:\/\/ruidera.uclm.es\/xmlui\/handle\/10578\/28638<\/a><\/li><li><i class=\"ai ai-doi\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/dx.doi.org\/10.18239\/jornadas_2021.34.30\" title=\"DOI de seguimiento:10.18239\/jornadas_2021.34.30\" target=\"_blank\">doi:10.18239\/jornadas_2021.34.30<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('271','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><div class=\"tp_publication tp_publication_inproceedings\"><div class=\"tp_pub_info\"><p class=\"tp_pub_author\"> Diaz-Verdejo, J.;  Mu\u00f1oz, F. J.;  Alonso, R. Estepa;  Alonso, A. Estepa;  Madinabeitia, G.<\/p><p class=\"tp_pub_title\"><a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('272','tp_links')\" style=\"cursor:pointer;\">Sobre las capacidades de detecci\u00f3n de los IDS basados en firmas<\/a> <span class=\"tp_pub_type tp_  inproceedings\">Proceedings Article<\/span> <\/p><p class=\"tp_pub_additional\"><span class=\"tp_pub_additional_in\">En: <\/span> Serrano, Manuel A.;  Fern\u00e1ndez-Medina, Eduardo;  Alcaraz, Cristina;  Castro, Noem\u00ed;  Calvo, Guillermo (Ed.): <span class=\"tp_pub_additional_booktitle\">Actas de las VI Jornadas Nacionales de Investigaci\u00f3n en Ciberseguridad, <\/span><span class=\"tp_pub_additional_pages\">pp. 55\u201364, <\/span><span class=\"tp_pub_additional_publisher\">Ediciones de la Universidad de Castilla-La Mancha, <\/span><span class=\"tp_pub_additional_year\">2021<\/span>, <span class=\"tp_pub_additional_isbn\">ISBN: 9788490444634<\/span>.<\/p><p class=\"tp_pub_menu\"><span class=\"tp_abstract_link\"><a id=\"tp_abstract_sh_272\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('272','tp_abstract')\" title=\"Mostrar resumen\" style=\"cursor:pointer;\">Resumen<\/a><\/span> | <span class=\"tp_resource_link\"><a id=\"tp_links_sh_272\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('272','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_272\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('272','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_272\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@inproceedings{diaz-verdejo-jnic21,<br \/>\r\ntitle = {Sobre las capacidades de detecci\u00f3n de los IDS basados en firmas},<br \/>\r\nauthor = {J. Diaz-Verdejo and F. J. Mu\u00f1oz and R. Estepa Alonso and A. Estepa Alonso and G. Madinabeitia},<br \/>\r\neditor = {Manuel A. Serrano and Eduardo Fern\u00e1ndez-Medina and Cristina Alcaraz and Noem\u00ed Castro and Guillermo Calvo},<br \/>\r\nurl = {https:\/\/ruidera.uclm.es\/xmlui\/handle\/10578\/28597},<br \/>\r\ndoi = {10.18239\/jornadas_2021.34.00},<br \/>\r\nisbn = {9788490444634},<br \/>\r\nyear  = {2021},<br \/>\r\ndate = {2021-01-01},<br \/>\r\nurldate = {2021-01-01},<br \/>\r\nbooktitle = {Actas de las VI Jornadas Nacionales de Investigaci\u00f3n en Ciberseguridad},<br \/>\r\npages = {55--64},<br \/>\r\npublisher = {Ediciones de la Universidad de Castilla-La Mancha},<br \/>\r\nseries = {Colecci\u00f3n Jornadas y Congresos},<br \/>\r\nabstract = {Los sistemas de detecci\u00f3n de intrusiones (IDS) pueden detectar actividades maliciosas y generar alertas a supervisar, por lo que constituyen el n\u00b4 ucleo de los sistemas de monitorizaci\u00f3n de la seguridad de las redes. Tradicionalmente, se ha asumido que los IDS basados en firmas (SIDS) ofrecen una capacidad de detecci\u00f3n y tasa de falsos positivos adecuadas, presentando limitaciones s\u00f3lo en la detecci\u00f3n de ataques 0-day. Sin embargo, estas capacidades est\u00e1n inequ\u00edvocamente asociadas a la calidad de las firmas disponibles, que var\u00edan no s\u00f3lo en el tiempo sino con la herramienta concreta utilizada. En este trabajo se exploran las capacidades de diversos sistemas SIDS ampliamente utilizados en un escenario real en el contexto de servicios web. Asimismo, se analiza la evoluci\u00f3n de sus prestaciones a lo largo del tiempo considerando la actualizaci\u00f3n de las firmas. Los resultados de nuestras pruebas evidencian una gran variabilidad en las prestaciones en funci\u00f3n de la herramienta seleccionada, as\u00ed como una deficiente cobertura de ataques conocidos, incluso cuando se optimizan las reglas para ajustarse al sistema a proteger. Consecuentemente, es necesario revisar el papel de los SIDS como elementos de protecci\u00f3n, ya que pueden proporcionar una falsa sensaci\u00f3n de seguridad.},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {inproceedings}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('272','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_abstract\" id=\"tp_abstract_272\" style=\"display:none;\"><div class=\"tp_abstract_entry\">Los sistemas de detecci\u00f3n de intrusiones (IDS) pueden detectar actividades maliciosas y generar alertas a supervisar, por lo que constituyen el n\u00b4 ucleo de los sistemas de monitorizaci\u00f3n de la seguridad de las redes. Tradicionalmente, se ha asumido que los IDS basados en firmas (SIDS) ofrecen una capacidad de detecci\u00f3n y tasa de falsos positivos adecuadas, presentando limitaciones s\u00f3lo en la detecci\u00f3n de ataques 0-day. Sin embargo, estas capacidades est\u00e1n inequ\u00edvocamente asociadas a la calidad de las firmas disponibles, que var\u00edan no s\u00f3lo en el tiempo sino con la herramienta concreta utilizada. En este trabajo se exploran las capacidades de diversos sistemas SIDS ampliamente utilizados en un escenario real en el contexto de servicios web. Asimismo, se analiza la evoluci\u00f3n de sus prestaciones a lo largo del tiempo considerando la actualizaci\u00f3n de las firmas. Los resultados de nuestras pruebas evidencian una gran variabilidad en las prestaciones en funci\u00f3n de la herramienta seleccionada, as\u00ed como una deficiente cobertura de ataques conocidos, incluso cuando se optimizan las reglas para ajustarse al sistema a proteger. Consecuentemente, es necesario revisar el papel de los SIDS como elementos de protecci\u00f3n, ya que pueden proporcionar una falsa sensaci\u00f3n de seguridad.<\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('272','tp_abstract')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_272\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"fas fa-globe\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/ruidera.uclm.es\/xmlui\/handle\/10578\/28597\" title=\"https:\/\/ruidera.uclm.es\/xmlui\/handle\/10578\/28597\" target=\"_blank\">https:\/\/ruidera.uclm.es\/xmlui\/handle\/10578\/28597<\/a><\/li><li><i class=\"ai ai-doi\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/dx.doi.org\/10.18239\/jornadas_2021.34.00\" title=\"DOI de seguimiento:10.18239\/jornadas_2021.34.00\" target=\"_blank\">doi:10.18239\/jornadas_2021.34.00<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('272','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><div class=\"tp_publication tp_publication_article\"><div class=\"tp_pub_info\"><p class=\"tp_pub_author\"> Garc\u00eda-Teodoro, P.;  D\u00edaz-Verdejo, J.;  Maci\u00e1-Fern\u00e1ndez, G.;  V\u00e1zquez, E.<\/p><p class=\"tp_pub_title\"><a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('315','tp_links')\" style=\"cursor:pointer;\">Anomaly-based network intrusion detection: Techniques, systems and challenges<\/a> <span class=\"tp_pub_type tp_  article\">Art\u00edculo de revista<\/span> <\/p><p class=\"tp_pub_additional\"><span class=\"tp_pub_additional_in\">En: <\/span><span class=\"tp_pub_additional_journal\">Computers and Security, <\/span><span class=\"tp_pub_additional_volume\">vol. 28, <\/span><span class=\"tp_pub_additional_number\">no 1-2, <\/span><span class=\"tp_pub_additional_pages\">pp. 18\u201328, <\/span><span class=\"tp_pub_additional_year\">2009<\/span>, <span class=\"tp_pub_additional_issn\">ISSN: 01674048<\/span>.<\/p><p class=\"tp_pub_menu\"><span class=\"tp_abstract_link\"><a id=\"tp_abstract_sh_315\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('315','tp_abstract')\" title=\"Mostrar resumen\" style=\"cursor:pointer;\">Resumen<\/a><\/span> | <span class=\"tp_resource_link\"><a id=\"tp_links_sh_315\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('315','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_315\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('315','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_315\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@article{Garcia-Teodoro2009,<br \/>\r\ntitle = {Anomaly-based network intrusion detection: Techniques, systems and challenges},<br \/>\r\nauthor = {P. Garc\u00eda-Teodoro and J. D\u00edaz-Verdejo and G. Maci\u00e1-Fern\u00e1ndez and E. V\u00e1zquez},<br \/>\r\ndoi = {10.1016\/j.cose.2008.08.003},<br \/>\r\nissn = {01674048},<br \/>\r\nyear  = {2009},<br \/>\r\ndate = {2009-01-01},<br \/>\r\nurldate = {2009-01-01},<br \/>\r\njournal = {Computers and Security},<br \/>\r\nvolume = {28},<br \/>\r\nnumber = {1-2},<br \/>\r\npages = {18--28},<br \/>\r\nabstract = {The Internet and computer networks are exposed to an increasing number of security threats. With new types of attacks appearing continually, developing flexible and adaptive security oriented approaches is a severe challenge. In this context, anomaly-based network intrusion detection techniques are a valuable technology to protect target systems and networks against malicious activities. However, despite the variety of such methods described in the literature in recent years, security tools incorporating anomaly detection functionalities are just starting to appear, and several important problems remain to be solved. This paper begins with a review of the most well-known anomaly-based intrusion detection techniques. Then, available platforms, systems under development and research projects in the area are presented. Finally, we outline the main challenges to be dealt with for the wide scale deployment of anomaly-based intrusion detectors, with special emphasis on assessment issues. textcopyright 2008 Elsevier Ltd. All rights reserved.},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {article}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('315','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_abstract\" id=\"tp_abstract_315\" style=\"display:none;\"><div class=\"tp_abstract_entry\">The Internet and computer networks are exposed to an increasing number of security threats. With new types of attacks appearing continually, developing flexible and adaptive security oriented approaches is a severe challenge. In this context, anomaly-based network intrusion detection techniques are a valuable technology to protect target systems and networks against malicious activities. However, despite the variety of such methods described in the literature in recent years, security tools incorporating anomaly detection functionalities are just starting to appear, and several important problems remain to be solved. This paper begins with a review of the most well-known anomaly-based intrusion detection techniques. Then, available platforms, systems under development and research projects in the area are presented. Finally, we outline the main challenges to be dealt with for the wide scale deployment of anomaly-based intrusion detectors, with special emphasis on assessment issues. textcopyright 2008 Elsevier Ltd. All rights reserved.<\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('315','tp_abstract')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_315\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"ai ai-doi\"><\/i><a class=\"tp_pub_list\" href=\"https:\/\/dx.doi.org\/10.1016\/j.cose.2008.08.003\" title=\"DOI de seguimiento:10.1016\/j.cose.2008.08.003\" target=\"_blank\">doi:10.1016\/j.cose.2008.08.003<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('315','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><\/div><\/div><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-8901c70 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"8901c70\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ca17ca1\" data-id=\"ca17ca1\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c465b8e elementor-widget elementor-widget-heading\" data-id=\"c465b8e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Proyectos destacados<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f334260 elementor-widget__width-initial elementor-widget elementor-widget-text-editor\" data-id=\"f334260\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><div class=\"teachpress_pub_list\"><form name=\"tppublistform\" method=\"get\"><a name=\"tppubs\" id=\"tppubs\"><\/a><\/form><div class=\"teachpress_publication_list\"><div class=\"tp_publication tp_publication_online\"><div class=\"tp_pub_info\"><p class=\"tp_pub_title\"> <span style=\"color: #038daa;font-size: 1,2rem;\"><b>A-TIC-224-UGR20<\/b> <\/span> &#8211; <a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('406','tp_links')\" style=\"cursor:pointer;\">Modelado de Ataques y Detecci\u00f3n de Incidentes de Ciberseguridad (MADINCI)<\/a><\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Entidad financiadora: <\/span><i>Universidad de Granada &#8211; Junta de Andaluc\u00eda<\/i> &#8211; Proyectos I+D+i del Programa Operativo FEDER 2020<\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Entidad\/es participantes: <\/span><i>Univ. Granada y Univ. Sevilla<\/i> &#8211; <span style=\"color: #888888;\">N. invest.: <\/span>6<\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Periodo: <\/span>01\/01\/2022 a 30\/06\/2023<\/p><p class=\"tp_pub_menu\"><span class=\"tp_resource_link\"><a id=\"tp_links_sh_406\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('406','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_406\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('406','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_406\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@online{madinci,<br \/>\r\ntitle = {Modelado de Ataques y Detecci\u00f3n de Incidentes de Ciberseguridad (MADINCI)},<br \/>\r\nurl = {\/neus-cslab\/madinci},<br \/>\r\nyear  = {2022},<br \/>\r\ndate = {2022-01-01},<br \/>\r\nurldate = {2022-01-01},<br \/>\r\nissuetitle = {Proyectos I+D+i del Programa Operativo FEDER 2020},<br \/>\r\nnumber = {A-TIC-224-UGR20},<br \/>\r\npages = {6},<br \/>\r\ninstitution = {Univ. Granada y Univ. Sevilla},<br \/>\r\norganization = {Universidad de Granada - Junta de Andaluc\u00eda},<br \/>\r\nseries = {01\/01\/2022 a 30\/06\/2023},<br \/>\r\nnote = {20000 \u20ac},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {online}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('406','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_406\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"fas fa-globe\"><\/i><a class=\"tp_pub_list\" href=\"\/neus-cslab\/madinci\" title=\"\/neus-cslab\/madinci\" target=\"_blank\">\/neus-cslab\/madinci<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('406','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><div class=\"tp_publication tp_publication_online\"><div class=\"tp_pub_info\"><p class=\"tp_pub_title\"> <span style=\"color: #038daa;font-size: 1,2rem;\"><b>PID2020-115199RB-I00 <\/b> <\/span> &#8211; <a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('3','tp_links')\" style=\"cursor:pointer;\">Detecci\u00f3n de ciberataques en \u201cindustria conectada\u201d e IoT mediante integraci\u00f3n y correlaci\u00f3n de alertas multifuente (COINCYDE)<\/a><\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Entidad financiadora: <\/span><i>Ministerio de Ciencia e Innovaci\u00f3n <\/i> &#8211; MICIN\/AEI\/10.13039\/50110 0 011033<\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Entidad\/es participantes: <\/span><i>Universidad de Granada \/ Universidad de Sevilla<\/i> &#8211; <span style=\"color: #888888;\">N. invest.: <\/span>8<\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Periodo: <\/span>01\/09\/2021 a 31\/08\/2024<\/p><p class=\"tp_pub_menu\"><span class=\"tp_abstract_link\"><a id=\"tp_abstract_sh_3\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('3','tp_abstract')\" title=\"Mostrar resumen\" style=\"cursor:pointer;\">Resumen<\/a><\/span> | <span class=\"tp_resource_link\"><a id=\"tp_links_sh_3\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('3','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_3\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('3','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_3\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@online{coincyde,<br \/>\r\ntitle = {Detecci\u00f3n de ciberataques en \u201cindustria conectada\u201d e IoT mediante integraci\u00f3n y correlaci\u00f3n de alertas multifuente (COINCYDE)},<br \/>\r\nauthor = {<br \/>\r\n<br \/>\r\n},<br \/>\r\nurl = {\/neus-cslab\/proyectos-idi\/coincyde},<br \/>\r\nyear  = {2021},<br \/>\r\ndate = {2021-09-01},<br \/>\r\nurldate = {2021-09-01},<br \/>\r\nbooktitle = {Detecci\u00f3n de ciberataques en \u201cindustria conectada\u201d e IoT mediante integraci\u00f3n y correlaci\u00f3n de alertas multifuente (COINCYDE)},<br \/>\r\nissuetitle = {MICIN\/AEI\/10.13039\/50110 0 011033},<br \/>\r\nnumber = {PID2020-115199RB-I00 },<br \/>\r\npages = {8},<br \/>\r\ninstitution = {Universidad de Granada \/ Universidad de Sevilla},<br \/>\r\norganization = {Ministerio de Ciencia e Innovaci\u00f3n },<br \/>\r\nseries = {01\/09\/2021 a 31\/08\/2024},<br \/>\r\nabstract = {Los sistemas de monitorizaci\u00f3n de la seguridad en red (NSM) se encuentran hoy en d\u00eda entre los componentes m\u00e1s relevantes para la detecci\u00f3n y respuesta a los ciberataques. Sin embargo, sus capacidades de detecci\u00f3n se limitan en su mayor\u00eda a ataques conocidos y tienden a generar una gran cantidad de alertas, muchas de las cuales son falsos positivos. As\u00ed, los operadores de ciberseguridad (CSO) deben supervisar una gran cantidad de alertas para determinar la ocurrencia real de incidentes, mientras que algunos de ellos permanecen sin ser detectados. Este proyecto tiene como objetivo desarrollar nuevas t\u00e9cnicas para mejorar las capacidades de detecci\u00f3n mediante la adici\u00f3n de nuevos m\u00e9todos basados en anomal\u00edas combinados con la correlaci\u00f3n y priorizaci\u00f3n de alertas incorporando informaci\u00f3n contextual de la red. Esto mejorar\u00e1 la calidad de las alertas y reducir\u00e1 la tasa de falsos positivos.<br \/>\r\n<br \/>\r\nEn esta propuesta se plantea el desarrollo de un NSM espec\u00edfico para plantas industriales con elementos del Internet of Things (IoT) y, m\u00e1s concretamente en uno de sus usos verticales: las SmartCity. Las instalaciones que pueden beneficiarse de la soluci\u00f3n objeto de este proyecto son aquellas que permiten el control y monitorizaci\u00f3n de parques de dispositivos inteligentes (IoT, SmartCity), desde una aplicaci\u00f3n o servicio web que se utiliza como interfaz de usuario para la gesti\u00f3n de servicios inteligentes. La elecci\u00f3n del escenario tiene<br \/>\r\nuna triple motivaci\u00f3n. Primero, por la gran relevancia y expansi\u00f3n de este tipo de redes en la actualidad. Segundo, el escenario plantea una serie dificultades y requisitos espec\u00edficos que no han sido convenientemente abordados en los SIEM actuales. Y tercero, la selecci\u00f3n del escenario permite acotar el contexto, lo que posibilita un abordaje adecuado de la incorporaci\u00f3n de informaci\u00f3n contextual.<br \/>\r\n<br \/>\r\nEl sistema a desarrollar incorporar\u00e1 m\u00faltiples detectores, incluyendo los usados habitualmente, considerando nuevos detectores espec\u00edficos para el escenario que est\u00e1n orientados a las diversas amenazas existentes. As\u00ed, se desarrollar\u00e1n detectores basados en anomal\u00edas a nivel del tr\u00e1fico observado (flujos), a nivel de aplicaci\u00f3n (sensorizaci\u00f3n) y a nivel de los servicios web usados para la operaci\u00f3n remota. Adicionalmente, se har\u00e1 uso de t\u00e9cnicas de inteligencia artificial para la correlaci\u00f3n y priorizaci\u00f3n de las alertas incorporando informaci\u00f3n relativa al estado e historia previa de la red. Esto permitir\u00e1 identificar falsos positivos, reducir el n\u00famero de alertas finalmente enviadas al CSO y mejorar la informaci\u00f3n en las mismas.<br \/>\r\n<br \/>\r\nUn elemento relevante y novedoso es el uso de una matriz de tr\u00e1fico generada a partir de flujos en diferentes escalas de tiempo. Esta matriz contiene informaci\u00f3n sobre las conexiones de red que pueden explotarse para m\u00faltiples usos. As\u00ed, se pueden establecer algunos indicadores de compromiso para identificar ataques. Tambi\u00e9n se puede utilizar para aplicar varios tipos de an\u00e1lisis de miner\u00eda de datos, como la b\u00fasqueda de patrones comunes entre flujos, realizar perfiles de tr\u00e1fico de servicios, evaluar la importancia y encontrar relaciones entre activos. La informaci\u00f3n extra\u00edda de esta matriz se utilizar\u00e1 como informaci\u00f3n contextual en la correlaci\u00f3n y priorizaci\u00f3n de alertas.<br \/>\r\n<br \/>\r\nFinalmente, la arquitectura propuesta incluye realimentaci\u00f3n a partir de las acciones del CSO, lo que permite evaluar la calidad de detecci\u00f3n y priorizaci\u00f3n y ajustar el rendimiento del sistema.},<br \/>\r\nnote = {47795 \u20ac},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {online}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('3','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_abstract\" id=\"tp_abstract_3\" style=\"display:none;\"><div class=\"tp_abstract_entry\">Los sistemas de monitorizaci\u00f3n de la seguridad en red (NSM) se encuentran hoy en d\u00eda entre los componentes m\u00e1s relevantes para la detecci\u00f3n y respuesta a los ciberataques. Sin embargo, sus capacidades de detecci\u00f3n se limitan en su mayor\u00eda a ataques conocidos y tienden a generar una gran cantidad de alertas, muchas de las cuales son falsos positivos. As\u00ed, los operadores de ciberseguridad (CSO) deben supervisar una gran cantidad de alertas para determinar la ocurrencia real de incidentes, mientras que algunos de ellos permanecen sin ser detectados. Este proyecto tiene como objetivo desarrollar nuevas t\u00e9cnicas para mejorar las capacidades de detecci\u00f3n mediante la adici\u00f3n de nuevos m\u00e9todos basados en anomal\u00edas combinados con la correlaci\u00f3n y priorizaci\u00f3n de alertas incorporando informaci\u00f3n contextual de la red. Esto mejorar\u00e1 la calidad de las alertas y reducir\u00e1 la tasa de falsos positivos.<br \/>\r\n<br \/>\r\nEn esta propuesta se plantea el desarrollo de un NSM espec\u00edfico para plantas industriales con elementos del Internet of Things (IoT) y, m\u00e1s concretamente en uno de sus usos verticales: las SmartCity. Las instalaciones que pueden beneficiarse de la soluci\u00f3n objeto de este proyecto son aquellas que permiten el control y monitorizaci\u00f3n de parques de dispositivos inteligentes (IoT, SmartCity), desde una aplicaci\u00f3n o servicio web que se utiliza como interfaz de usuario para la gesti\u00f3n de servicios inteligentes. La elecci\u00f3n del escenario tiene<br \/>\r\nuna triple motivaci\u00f3n. Primero, por la gran relevancia y expansi\u00f3n de este tipo de redes en la actualidad. Segundo, el escenario plantea una serie dificultades y requisitos espec\u00edficos que no han sido convenientemente abordados en los SIEM actuales. Y tercero, la selecci\u00f3n del escenario permite acotar el contexto, lo que posibilita un abordaje adecuado de la incorporaci\u00f3n de informaci\u00f3n contextual.<br \/>\r\n<br \/>\r\nEl sistema a desarrollar incorporar\u00e1 m\u00faltiples detectores, incluyendo los usados habitualmente, considerando nuevos detectores espec\u00edficos para el escenario que est\u00e1n orientados a las diversas amenazas existentes. As\u00ed, se desarrollar\u00e1n detectores basados en anomal\u00edas a nivel del tr\u00e1fico observado (flujos), a nivel de aplicaci\u00f3n (sensorizaci\u00f3n) y a nivel de los servicios web usados para la operaci\u00f3n remota. Adicionalmente, se har\u00e1 uso de t\u00e9cnicas de inteligencia artificial para la correlaci\u00f3n y priorizaci\u00f3n de las alertas incorporando informaci\u00f3n relativa al estado e historia previa de la red. Esto permitir\u00e1 identificar falsos positivos, reducir el n\u00famero de alertas finalmente enviadas al CSO y mejorar la informaci\u00f3n en las mismas.<br \/>\r\n<br \/>\r\nUn elemento relevante y novedoso es el uso de una matriz de tr\u00e1fico generada a partir de flujos en diferentes escalas de tiempo. Esta matriz contiene informaci\u00f3n sobre las conexiones de red que pueden explotarse para m\u00faltiples usos. As\u00ed, se pueden establecer algunos indicadores de compromiso para identificar ataques. Tambi\u00e9n se puede utilizar para aplicar varios tipos de an\u00e1lisis de miner\u00eda de datos, como la b\u00fasqueda de patrones comunes entre flujos, realizar perfiles de tr\u00e1fico de servicios, evaluar la importancia y encontrar relaciones entre activos. La informaci\u00f3n extra\u00edda de esta matriz se utilizar\u00e1 como informaci\u00f3n contextual en la correlaci\u00f3n y priorizaci\u00f3n de alertas.<br \/>\r\n<br \/>\r\nFinalmente, la arquitectura propuesta incluye realimentaci\u00f3n a partir de las acciones del CSO, lo que permite evaluar la calidad de detecci\u00f3n y priorizaci\u00f3n y ajustar el rendimiento del sistema.<\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('3','tp_abstract')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_3\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"fas fa-globe\"><\/i><a class=\"tp_pub_list\" href=\"\/neus-cslab\/proyectos-idi\/coincyde\" title=\"\/neus-cslab\/proyectos-idi\/coincyde\" target=\"_blank\">\/neus-cslab\/proyectos-idi\/coincyde<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('3','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><div class=\"tp_publication tp_publication_online\"><div class=\"tp_pub_info\"><p class=\"tp_pub_title\"> <span style=\"color: #038daa;font-size: 1,2rem;\"><b>PYC20-RE-087-USE<\/b> <\/span> &#8211; <a class=\"tp_title_link\" onclick=\"teachpress_pub_showhide('405','tp_links')\" style=\"cursor:pointer;\">Sistema para la detecci\u00f3n temprana de ciberataques en industria conectada e IoT mediante detecci\u00f3n de anomal\u00edas multiplanta<\/a><\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Entidad financiadora: <\/span><i>Universidad de Sevilla &#8211; Junta de Andaluc\u00eda<\/i> &#8211; Proyectos singulares de actuaciones de transferencia en los CEI en las \u00e1reas RIS3 (CEI20)<\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Entidad\/es participantes: <\/span><i>Universidad de Sevilla, Wellness TechGroup como agente agregado<\/i> &#8211; <span style=\"color: #888888;\">N. invest.: <\/span>5<\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Periodo: <\/span>01\/01\/2021 a 31\/12\/2022<\/p><p class=\"tp_pub_menu\"><span class=\"tp_resource_link\"><a id=\"tp_links_sh_405\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('405','tp_links')\" title=\"Mostrar enlaces y recursos\" style=\"cursor:pointer;\">Enlaces<\/a><\/span> | <span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_405\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('405','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_405\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@online{cei2,<br \/>\r\ntitle = {Sistema para la detecci\u00f3n temprana de ciberataques en industria conectada e IoT mediante detecci\u00f3n de anomal\u00edas multiplanta},<br \/>\r\nurl = {\/neus-cslab\/proyectosidi\/cei2},<br \/>\r\nyear  = {2021},<br \/>\r\ndate = {2021-01-01},<br \/>\r\nurldate = {2021-01-01},<br \/>\r\nissuetitle = {Proyectos singulares de actuaciones de transferencia en los CEI en las \u00e1reas RIS3 (CEI20)},<br \/>\r\nnumber = {PYC20-RE-087-USE},<br \/>\r\npages = {5},<br \/>\r\ninstitution = {Universidad de Sevilla, Wellness TechGroup como agente agregado},<br \/>\r\norganization = {Universidad de Sevilla - Junta de Andaluc\u00eda},<br \/>\r\nseries = {01\/01\/2021 a 31\/12\/2022},<br \/>\r\nnote = {68550 \u20ac},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {online}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('405','tp_bibtex')\">Cerrar<\/a><\/p><\/div><div class=\"tp_links\" id=\"tp_links_405\" style=\"display:none;\"><div class=\"tp_links_entry\"><ul class=\"tp_pub_list\"><li><i class=\"fas fa-globe\"><\/i><a class=\"tp_pub_list\" href=\"\/neus-cslab\/proyectosidi\/cei2\" title=\"\/neus-cslab\/proyectosidi\/cei2\" target=\"_blank\">\/neus-cslab\/proyectosidi\/cei2<\/a><\/li><\/ul><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('405','tp_links')\">Cerrar<\/a><\/p><\/div><\/div><\/div><div class=\"tp_publication tp_publication_online\"><div class=\"tp_pub_info\"><p class=\"tp_pub_title\"> <span style=\"color: #038daa;font-size: 1,2rem;\"><b>2020\/00000172<\/b> <\/span> &#8211; Detecci\u00f3n Inteligente de Incidentes de Ciberseguridad en redes IoT en base a n-gram\u00e1ticas adaptativas<\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Entidad financiadora: <\/span><i>US &#8211; Junta de Andaluc\u00eda<\/i> &#8211; Proyectos singulares de actuaciones de transferencia en los CEI en las \u00e1reas RIS3<\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Entidad\/es participantes: <\/span><i>Universidad de Sevilla, Wellness TechGroup como agente agregado<\/i><\/p><p class=\"tp_pub_additional\"> <span style=\"color: #888888;\">Periodo: <\/span>01\/03\/2020\ta 30\/09\/2021<\/p><p class=\"tp_pub_menu\"><span class=\"tp_bibtex_link\"><a id=\"tp_bibtex_sh_407\" class=\"tp_show\" onclick=\"teachpress_pub_showhide('407','tp_bibtex')\" title=\"Mostrar entrada BibTeX \" style=\"cursor:pointer;\">BibTeX<\/a><\/span><\/p><div class=\"tp_bibtex\" id=\"tp_bibtex_407\" style=\"display:none;\"><div class=\"tp_bibtex_entry\"><pre>@online{cei1,<br \/>\r\ntitle = {Detecci\u00f3n Inteligente de Incidentes de Ciberseguridad en redes IoT en base a n-gram\u00e1ticas adaptativas},<br \/>\r\nyear  = {2020},<br \/>\r\ndate = {2020-01-01},<br \/>\r\nurldate = {2020-01-01},<br \/>\r\nissuetitle = {Proyectos singulares de actuaciones de transferencia en los CEI en las \u00e1reas RIS3},<br \/>\r\nnumber = {2020\/00000172},<br \/>\r\ninstitution = {Universidad de Sevilla, Wellness TechGroup como agente agregado},<br \/>\r\norganization = {US - Junta de Andaluc\u00eda},<br \/>\r\nseries = {01\/03\/2020\ta 30\/09\/2021},<br \/>\r\nnote = {33000 \u20ac},<br \/>\r\nkeywords = {},<br \/>\r\npubstate = {published},<br \/>\r\ntppubtype = {online}<br \/>\r\n}<br \/>\r\n<\/pre><\/div><p class=\"tp_close_menu\"><a class=\"tp_close\" onclick=\"teachpress_pub_showhide('407','tp_bibtex')\">Cerrar<\/a><\/p><\/div><\/div><\/div><\/div><\/div><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Detecci\u00f3n de intrusiones Los Sistemas de Detecci\u00f3n de Intrusos (IDS) son herramientas de seguridad que, al igual que otras medidas como software antivirus, cortafuegos y\u00a0esquemas de control de acceso, est\u00e1n destinados a fortalecer la seguridad de los sistemas de informaci\u00f3n y comunicaci\u00f3n.\u00a0Con la aparici\u00f3n continua de nuevos tipos de ataques, que se desarrollan de forma [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":876,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"ocean_post_layout":"full-width","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"0","ocean_second_sidebar":"0","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"0","ocean_custom_header_template":"0","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"0","ocean_menu_typo_font_family":"0","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"0","footnotes":""},"class_list":["post-1806","page","type-page","status-publish","hentry","entry"],"_links":{"self":[{"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/pages\/1806","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/comments?post=1806"}],"version-history":[{"count":23,"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/pages\/1806\/revisions"}],"predecessor-version":[{"id":1980,"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/pages\/1806\/revisions\/1980"}],"up":[{"embeddable":true,"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/pages\/876"}],"wp:attachment":[{"href":"https:\/\/dtstc.ugr.es\/neus-cslab\/wp-json\/wp\/v2\/media?parent=1806"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}