A supervised machine learning approach to classify host roles on line using sFlow

Abstract

Classifying host roles based on network traffic behavior is valuable for network security analysis and detecting security policy violation. Behavior-based network security analysis has advantages over traditional approaches such as code patterns or signatures. Modeling host roles based on network flow data is challenging because of the huge volume of network traffic and overlap among host roles. Many studies of network traffic classification have focused on classifying applications such as web, peer-to-peer, and DNS traffic. In general, machine learning approaches have been applied on classifying applications, security awareness, and anomaly detection. In this paper, we present a supervised machine learning approach that use On-Line Support Vector Machine and Decision Tree to classify host roles. We collect sFlow data from main gateways of a large campus network. We classify different roles, namely, clients versus servers, regular web non-email servers versus web email servers, clients at personal offices versus public places of laboratories and libraries, and personal office clients from two different colleges. We achieved very high classification accuracy, i.e., 99.2% accuracy in classifying clients versus servers, 100% accuracy in classifying a regular web non-email servers versus web email servers, 93.3% accuracy in classifying clients at personnel offices versus public places, and 93.3% accuracy in classifying clients at personal offices from two different colleges.

Behavior-Aware Network Segmentation using IP Flows

“…We performed multiple grid searches, then gradually refined the grid parameters according to the accuracy of the results. Initial grid search parameters were: minPts = [25,50,100,200,400], ϵ = [1,2,4,8,16,32,64,128]. The grid search settled with minPts set to 40 and ϵ set to 5.…”

“…The majority of the previous works focus on the profiling network behavior of individual hosts [3,10,26], their classification [14,16] and clustering [21]. The authors of [10] use the change point detection techniques and the indicator of "freshness" to cluster the hosts according to its different activities over time.…”

Tuning optimal traffic measurement parameters in virtual networks with machine learning

“…They study several use-cases and show the applicability and benefits of adopting the machine learning paradigm to the networking field. Following this trend, anomaly detection in the cloud with machine learning is studied in [10], VNF anomaly detection in [11], traffic control with deep learning in [12], and identification of host roles with supervised learning with sFlow in [13].…”

SPINZ: A Speculating Incident Zone Systemfor Incident Handling

“…It evaluates the results of the countermeasures. A CSIRT loops from (6) to (9) until the situation is judged that incident handling operations are not necessary. If a new incident is discovered, return to (2).…”

“…Therefore, predicting role change is suitable to grasp communication-flow changes in a local network. Li et al [9] studied a classification method to separate internal-device roles into Client or Server. Their method applies a statistical classifier to long-term flow data.…”