NetFlow-Based Network Intrusion Prevention System Using Machine Learning
摘要
As the globe grows more interconnected, more malicious actors are taking advantage of network vulnerabilities. Network Intrusion Prevention Systems (NIPS) can be deployed to mitigate some of these risks; however, they can become a bottleneck for a quickly expanding network, since each packet from each network conversation must be examined. As this is a very memory-intensive task, this paper implements a new class of NIPS that uses an aggregated conversation summary called NetFlow, analyzed through a machine learning algorithm, to detect malicious activity while packets pass through at full speed. The proposed NIPS (NF-Based-NIPS) was then tested against a well-established NIPS known as Snort to determine its effectiveness, where it was able to keep up with Snort for the most part. Additionally, a comparative analysis of previous works was performed to determine which NetFlow features should be fed into the machine learning classifier.