Classification rule-based models for malicious activity detection

Abstract

Entities providing services based on Information and Communications Technologies (Internet access providers, landline and mobile, among others) are targets of malicious activities that cause millions in losses and affect their prestige. In order to prevent such damage, it is necessary to analyze ev ent streams generated by service provision. Event streams have special features, such as high speeds and large amounts of data, as well as diversity of sources and formats. Therefore, the use of effective models that can be used in real time are required. Rule-based models are reported as one of the most used for malicious activities detection. In this paper, several classification rule-based models are discussed. For a better understanding of each model, their general schemes are outlined. Finally, identified problems in the models are presented.