Detecção de anomalias em sistemas computacionais com base em comportamento.

Abstract

The increasing complexity of systems connected to a network highlights the need for mechanisms capable of identifying behaviors that deviate from expected operation, especially in scenarios where no predefined signatures or rules exist for specific threats. In this context, this work presents a proof of concept for anomaly detection in an experimental environment that simulates a distributed device system, considering two complementary monitoring perspectives: network-level and application-level. The proposed approach is based on modeling the benign behavior of the system using metrics extracted from communication flows and request records processed by the central application, employing Autoencoder models trained exclusively on normal data to identify deviations over time windows. The experiments considered scenarios such as network reconnaissance, API key brute force, endpoint enumeration, and exploitation of code weaknesses, allowing the analysis of how different types of anomalies manifest at each monitoring level. The results demonstrate that the approach was able to identify anomalous behaviors in the system and highlight that network and application perspectives are complementary, providing a more comprehensive view of the observed behavior in distributed systems.