A Session Based Approach for Aggregating Network Traffic Data -- The SANTA Dataset

Wheelus, Charles; Khoshgoftaar, Taghi M.; Zuech, Richard; Najafabadi, Maryam M.

doi:10.1109/bibe.2014.72

Cited by 19 publications

(18 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The network session-based SANTA attributes, proposed in our previous research [39], are used to characterize the network traffic and evaluate the efficacy of predictive models trained using machine learning algorithms. The attributes used are listed in Table 3.…”

Section: Iot Network Traffic Featuresmentioning

confidence: 99%

IoT Network Security: Threats, Risks, and a Data-Driven Defense Framework

Wheelus

Zhu

2020

IoT

Self Cite

View full text Add to dashboard Cite

The recent surge in Internet of Things (IoT) deployment has increased the pace of integration and extended the reach of the Internet from computers, tablets and phones to a myriad of devices in our physical world. Driven by the IoT, with each passing day, the Internet becomes more integrated with everyday life. While IoT devices provide endless new capabilities and make life more convenient, they also vastly increase the opportunity for nefarious individuals, criminal organizations and even state actors to spy on, and interfere with, unsuspecting users of IoT systems. As this looming crisis continues to grow, calls for data science approaches to address these problems have increased, and current research shows that predictive models trained with machine learning algorithms hold great potential to mitigate some of these issues. In this paper, we first carry out an analytics approach to review security risks associated with IoT systems, and then propose a machine learning-based solution to characterize and detect IoT attacks. We use a real-world IoT system with secured gate access as a platform, and introduce the IoT system in detail, including features to capture security threats/attacks to the system. By using data collected from a nine month period as our testbed, we evaluate the efficacy of predictive models trained by means of machine learning, and propose design principles and a loose framework for implementing secure IoT systems.

show abstract

Section: Iot Network Traffic Featuresmentioning

confidence: 99%

IoT Network Security: Threats, Risks, and a Data-Driven Defense Framework

Wheelus

Zhu

2020

IoT

Self Cite

View full text Add to dashboard Cite

show abstract

“…The repository is managed and contains some recent data sets. 33 https://nesg.ugr.es/nesg-ugr16/index.php 34 http://netweb.ing.unibs.it/~ntw/tools/traces/) 35 https://csr.lanl.gov/data/2017.html 36 https://www.unsw.adfa.edu.au/unsw-canberra-cyber/cybersecurity/ ADFA-NB15-Datasets/ 37 https://www.azsecure-data.org/other-data.html CAIDA 38 . CAIDA collects different types of data sets, with varying degree of availability (public access or on request), and provides a search engine.…”

Section: A Data Repositoriesmentioning

confidence: 99%

A survey of network-based intrusion detection data sets

Ring

Wunderlich

Scheuring

et al. 2019

Computers & Security

535

235

View full text Add to dashboard Cite

Labeled data sets are necessary to train and evaluate anomaly-based network intrusion detection systems. This work provides a focused literature survey of data sets for networkbased intrusion detection and describes the underlying packetand flow-based network data in detail. The paper identifies 15 different properties to assess the suitability of individual data sets for specific evaluation scenarios. These properties cover a wide range of criteria and are grouped into five categories such as data volume or recording environment for offering a structured search. Based on these properties, a comprehensive overview of existing data sets is given. This overview also highlights the peculiarities of each data set. Furthermore, this work briefly touches upon other sources for network-based data such as traffic generators and data repositories. Finally, we discuss our observations and provide some recommendations for the use and the creation of network-based data sets.

show abstract

“…However, nearly all of the 14 million flows are malicious since real background traffic is missing. Wheelus et al [29] and Zuech et al [30] both proposed flow-based data sets (SANTA and IRSC respectively), though, neither of the two data sets are publicly available to the best of our knowledge. The UNB IDS datasets include useful flow summaries, as well as useful and detailed behavioural metadata summaries per flow.…”

Section: Raw Events Metadata and Flowsmentioning

confidence: 99%

Are public intrusion datasets fit for purpose characterising the state of the art in intrusion event datasets

Kenyon¹,

Deka

Elizondo

2020

Computers & Security

View full text Add to dashboard Cite

In recent years cybersecurity attacks have caused major disruption and information loss for online organisations, with high profile incidents in the news. One of the key challenges in advancing the state of the art in intrusion detection is the lack of representative datasets. These datasets typically contain millions of time-ordered events (e.g. network packet traces, flow summaries, log entries); subsequently analysed to identify abnormal behavior and specific attacks [1]. Generating realistic datasets has historically required expensive networked assets, specialised traffic generators, and considerable design preparation. Even with advances in virtualisation it remains challenging to create and maintain a representative environment. Major improvements are needed in the design, quality and availability of datasets, to assist researchers in developing advanced detection techniques. With the emergence of new technology paradigms, such as intelligent transport and autonomous vehicles, it is also likely that new classes of threat will emerge [2]. Given the rate of change in threat behavior [3] datasets become quickly obsolete, and some of the most widely cited datasets date back over two decades. Older datasets have limited value: often heavily filtered and anonymised, with unrealistic event distributions, and opaque design methodology. The relative scarcity of (Intrusion Detection System) IDS datasets is compounded by the lack of a central registry, and inconsistent information on provenance. Researchers may also find it hard to locate datasets or understand their relative merits. In addition, many datasets rely on simulation, originating from academic or government institutions. The publication process itself often creates conflicts, with the need to de-identify sensitive information in order to meet regulations such as General Data Protection Act (GDPR) [4]. Another final issue for researchers is the lack of standardised metrics with which to compare dataset quality. In this paper we attempt to classify the most widely used public intrusion datasets, providing references to archives and associated literature. We illustrate their relative utility and scope, highlighting the threat composition, formats, special features, and associated limitations. We identify best practice in dataset design, and describe potential pitfalls of designing anomaly detection techniques based on data that may be either inappropriate, or compromised due to unrealistic threat coverage. Such contributions as made in this paper is expected to facilitate continuous research and development for effectively combating the constantly evolving cyber threat landscape.

show abstract

A Session Based Approach for Aggregating Network Traffic Data -- The SANTA Dataset

Cited by 19 publications

References 6 publications

IoT Network Security: Threats, Risks, and a Data-Driven Defense Framework

IoT Network Security: Threats, Risks, and a Data-Driven Defense Framework

A survey of network-based intrusion detection data sets

Are public intrusion datasets fit for purpose characterising the state of the art in intrusion event datasets

Contact Info

Product

Resources

About