Random Forest e Suricata: separar sinal de ruído em alertas de intrusão

Abstract

The increasing volume and complexity of cyberattacks make it necessary to adopt mechanisms that support the monitoring and analysis of security events in computer networks. Intrusion Detection Systems can identify suspicious activities; however, the large number of generated alerts may hinder manual analysis and increase the occurrence of false positives. In this context, this work proposes an Intrusion Detection System with Machine Learning, integrating Suricata, the Random Forest algorithm, and a graphical interface to support alert analysis. The proposed solution includes Suricata log monitoring, event processing through a classification model, presentation of the verdict and confidence level for each alert, as well as history storage, filters, dashboards, and configuration features. For the initial experiments, a CSV version of the CSE-CIC-IDS2018 dataset containing labeled network flows was used. The data underwent cleaning, attribute conversion, target variable definition, and division between training and testing sets. The Random Forest model was selected due to its robustness, ability to handle multiple attributes, and capability to analyze feature importance. As preliminary results, the system requirements were defined, the logical architecture was designed, the initial model training was performed, and interface prototypes were developed in Figma. It is expected that the continuation of the project will integrate these components into a functional application, contributing to a more organized, accessible, and efficient alert analysis process.