Authors:
Gustavo Gonzalez-Granadillo
1
;
Rodrigo Diaz
1
;
Ibéria Medeiros
2
;
Susana Gonzalez-Zarzosa
1
and
Dawid Machnicki
1
Affiliations:
1
Atos Research & Innovation, Cybersecurity Laboratory and Spain
;
2
LASIGE, Faculty of Sciences, University of Lisboa and Portugal
Keyword(s):
Machine Learning, One-class SVM, Anomaly Detection, Network Traffic Behavior, NetFlow.
Related
Ontology
Subjects/Areas/Topics:
Data and Application Security and Privacy
;
Information and Systems Security
;
Information Assurance
;
Management of Computing Security
;
Network Security
;
Security Management
;
Security Verification and Validation
;
Wireless Network Security
Abstract:
Network anomaly detection using NetFlow has been widely studied during the last decade. NetFlow provides the ability to collect network traffic attributes (e.g., IP source, IP destination, source port, destination port, protocol) and allows the use of association rule mining to extract the flows that have caused a malicious event. Despite of all the developments in network anomaly detection, the most popular procedure to detect non-conformity patterns in network traffic is still manual inspection during the period under analysis (e.g., visual analysis of plots, identification of variations in the number of bytes, packets, flows). This paper presents a Live Anomaly Detection System (LADS) based on One class Support Vector Machine (One-class SVM) to detect traffic anomalies. Experiments have been conducted using a valid data-set containing over 1.4 million packets (captured using NetFlow v5 and v9) that build models with one and several features in order to identify the approach that m
ost accurately detects traffic anomalies in our system. A multi-featured approach that restricts the analysis to one IP address and extends it in terms of samples (valid and invalid ones) is considered as a promising approach in terms of accuracy of the detected malicious instances.
(More)