As the globe grows more interconnected, more malicious actors are taking advantage of network vulnerabilities. Network Intrusion Prevention Systems (NIPS) can be deployed to mitigate some of these risks; however, they can become a bottleneck for a quickly expanding network, since each packet from each network conversation must be examined. As this is a very memory-intensive task, this paper implements a new class of NIPS that uses an aggregated conversation summary called NetFlow, analyzed through a machine learning algorithm, to detect malicious activity while packets pass through at full speed. The proposed NIPS (NF-Based-NIPS) was then tested against a well-established NIPS known as Snort to determine its effectiveness, where it was able to keep up with Snort for the most part. Additionally, a comparative analysis of previous works was performed to determine which NetFlow features should be fed into the machine learning classifier.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

NetFlow-Based Network Intrusion Prevention System Using Machine Learning

  • Jacinth Daniel Moses,
  • Kayvan Karim,
  • Hani Ragab Hassen,
  • Hadj Batatia

摘要

As the globe grows more interconnected, more malicious actors are taking advantage of network vulnerabilities. Network Intrusion Prevention Systems (NIPS) can be deployed to mitigate some of these risks; however, they can become a bottleneck for a quickly expanding network, since each packet from each network conversation must be examined. As this is a very memory-intensive task, this paper implements a new class of NIPS that uses an aggregated conversation summary called NetFlow, analyzed through a machine learning algorithm, to detect malicious activity while packets pass through at full speed. The proposed NIPS (NF-Based-NIPS) was then tested against a well-established NIPS known as Snort to determine its effectiveness, where it was able to keep up with Snort for the most part. Additionally, a comparative analysis of previous works was performed to determine which NetFlow features should be fed into the machine learning classifier.