Serverless computing is a novel usage of cloud computing that offers programmers an environment to execute functions with no concerns on the infrastructure where the code runs. This work presents a serverless implementation of a technique used in cybersecurity, which focuses on the identification of unexpected behaviors from network users by means of TopK rankings. The implementation proposed leverages the potential of serverless computing by integrating the following services from Amazon Web Services: Lambda, DynamoDB, SQS and S3. The running time required to process user network traffic was dramatically reduced in comparison to other implementations of the same algorithm.

A major goal of current computer network security systems is to protect the network from outside attackers; however, protecting the network from its own users is still an unattended problem. In campus area networks, the risk of having internal attacks is high because of their topologies and the amount of users. This work proposes a new approach to identify whether a network user is having or not a normal behavior, by analyzing host traffic using top-k ranking similarity measures. The result of this analysis could be an input of intrusion detection systems. The document presents an experiment where real-time traffic of different users in a campus area network is compared to a reference traffic that corresponds to one of them.

Network-user profiling has been used as security technique to detect unknown or malicious behaviors. Top-k rankings of reached services is a new technique for building user profiles. This technique requires to keep in memory all the traffic data during a period of time to build the rankings. However, a single user can produce gigabytes of network traffic data, which may result in low execution performance and out-of memory errors. This work proposes a MapReduce approach that generates top-k rankings from huge network capture files.

Anomaly-based intrusion detection systems use profiles to characterize expected behavior of network users. Most of these systems characterize the entire network traffic within a single profile. This work proposes a user-level anomaly-based intrusion detection methodology using only the user’s network traffic. The proposed profile is a collection of TopK rankings of reached services by the user. To detect unexpected behaviors, the real-time traffic is organized into TopK rankings and compared to the profile using similarity measures. The experiments demonstrated that the proposed methodology was capable of detecting a particular kind of malware attack in all the users tested.

Small and medium sized businesses [SMBs] play a crucial role in emerging economies as they serve as the primary employer and source of development for individuals and society. SMBs face significant challenges in their development, and few manage to survive beyond 10 years to be considered established businesses. Typically, information technologies do not act as strategic partners for SMBs that support their growth and address business problems; they often remain completely separate from the business. Several reasons contribute to the lack of adoption of these technologies, including limited resources, lack of technical expertise, insufficient funding, concerns about return on investment, unclear use cases, and resistance to change. This research report aims to identify models that study how SMBs adopt new technologies and the barriers faced in this process, whether at the organizational or personal level.