A Comparative Study on Network Traffic Clustering

Yang, Liu; Xue, Hanxiao; Wei, Guocheng; Wu, Lisu; Wang, Yu

doi:10.1007/978-3-030-36938-5_27

Cited by 2 publications

(3 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These methods range from automated methods applying wavelet analysis [16] to graph theory [17], basic machine learning [14,18], and deep learning [12]. Clustering [13,[19][20][21][22][23] and autoencoders [4,13,[24][25][26][27][28] are popular methods, since they can detect patterns in data using unsupervised learning and hence do not require labelled training data.…”

Section: Methodsmentioning

confidence: 99%

“…Clustering has been widely applied for network anomaly detection [19,20]. With clustering, anomalous data typically appear as outliers that have higher distance to centroids of clusters or form smaller clusters.…”

Section: Methodsmentioning

confidence: 99%

“…Münz et al [21] applied K-means clustering using the numbers of packets, bytes, and source-destination ports as features. Liu et al [20] combined K-means clustering with Principal Component Analysis (PCA) for dimensionality reduction. Pagliari et al [22] used bi-clustering combined with Support Vector Machine (SVM).…”

Section: Methodsmentioning

confidence: 99%

See 2 more Smart Citations

Data Exfiltration Detection on Network Metadata with Autoencoders

Willems¹,

Kohls

Kamp³

et al. 2023

Electronics

View full text Add to dashboard Cite

We designed a Network Exfiltration Detection System (NEDS) to detect data exfiltration as occurring in ransomware attacks. The NEDS operates on aggregated metadata, which is more privacy-friendly and allows analysis of large volumes of high-speed network traffic. The NEDS aggregates metadata from multiple, sequential sessions between pairs of hosts in a network, which captures exfiltration by both stateful and stateless protocols. The aggregated metadata include averages per session of both packet count, request entropy, duration, and payload size, as well as the average time between sequential sessions and the amount of aggregated sessions. The NEDS applies a number of autoencoder models with unsupervised learning to detect anomalies, where each autoencoder model targets different protocols. We trained the autoencoder models with real-life data collected at network sensors in the National Detection Network as operated by the National Cyber Security Centre in the Netherlands, and configured the detection threshold by varying the false positive rate. We evaluated the detection performance by injecting exfiltration over different channels, including DNS tunnels and uploads to FTP servers, web servers, and cloud storage. Our experimental results show that aggregation significantly increases detection performance of exfiltration that happens over longer time, most notably, DNS tunnels. Our NEDS can be applied to detect exfiltration either in near-real-time data analysis with limited false positive rates, or in captured data to aid in post-incident analysis.

show abstract