ICACT20230053 Question.1
Questioner: m11007502@mail.ntust.edu.tw 2023-02-20 오후 4:37:14 |
ICACT20230053 Answer.1
Answer by Auhor ycc@nttu.edu.tw 2023-02-20 오후 4:37:14
Chrome  Click!! |
| Thank you for your presentation. I have a few questions I would like to ask in this research.
So is your system fully automated?
Best Regards, |
Thanks for your question!
Our system fully integrates several parts, including data proccesing, clustering technology, and firewall technology. We also automate the system so that the system can continue to defend against new attacks.
Best Regards. |
ICACT20230053 Question.2
Questioner: saocd@viettel.com.vn 2023-02-22 오후 12:07:33 |
ICACT20230053 Answer.2
Answer by Auhor ycc@nttu.edu.tw 2023-02-22 오후 12:07:33
Chrome Click!! |
| Glad to see your presentation. I have two questions, first, in your proposed method, when you classify your data why you use K-mean. And why you choose K values, which is the number of cluster centers. Thanks.
|
Thanks for your question! In this case (SSH data) we set the k value to 31, like we mentioned in the youtube video, we decide k value via WCSS. Best regards. |
ICACT20230053 Question.3
Questioner: 6025211020@mhs.its.ac.id 2023-02-21 오후 3:45:09 |
ICACT20230053 Answer.3
Answer by Auhor ycc@nttu.edu.tw 2023-02-21 오후 3:45:09
Chrome Click!! |
| An Intelligence Defense System with SNORT Rules is an interesting study. Can you explain how many features are stored in dataframe format from Cowrie honeypot log data? Which features are used in the clustering process? And why were those features chosen? Is it the most effective and efficient approach to create a K-Means Clustering model to include all the features? Thank you very much. |
Thanks for your question! In fact, we have many features, such as packet timestamp, session timestamp, src_port, ip, paylod, paylaod_lenth, avg payload lenth and we also record country, ISP, etc. through GeoIP database, we use payload to do some preprocessing for k-means clustering, Since our goal is to group similar payloads together and generate regular expressions, the other features are mainly for further research. Best reagards. |
ICACT20230053 Question.4
Questioner: nanduris@cdac.in 2023-02-21 오후 3:54:50 |
ICACT20230053 Answer.4
Answer by Auhor ycc@nttu.edu.tw 2023-02-21 오후 3:54:50
Chrome Click!! |
| It's an interesting work. Could you tell us whether did you try any other unsupervised learning method to say k-Means gives better results than others? |
Thanks for your question! For our real-time defense system, time cost and clean system structure are important, we have to cluster quickly in a large amount of data. In addition to k-means, we also tried other methods such as db-scan and Hierarchical clustering, but none of them fit our requirements. Best reagards. |
ICACT20230053 Question.5
Questioner: fialle@g.skku.edu 2023-02-21 오후 9:34:47 |
ICACT20230053 Answer.5
Answer by Auhor ycc@nttu.edu.tw 2023-02-21 오후 9:34:47
Chrome Click!! |
| Your work is very interesting. My question is that what are the drawback and limitations of your approach and how can you mitigate them? |
Thanks for your question! In fact, we encountered a problem when generating regular expression rules. Due to the forced grouping of k-means, some group contain payloads with low similarity. We are studying the use of LSHash technology to do finer-grained grouping and solve this problem. Best regards. |
