An evaluation of a virtual network function for real-time threat detection using stream processing

Lopez, Martin Andreoni; Lobato, Antonio Gonzalez Pastana; Duarte, Otto Carlos Muniz Bandeira; Pujolle, Guy

doi:10.1109/mobisecserv.2018.8311440

Cited by 15 publications

(8 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Another strategy that relies on artificial intelligence is Reference , which proposes a virtualized network function (VNF) that implements a distributed stream processing technique for real‐time threat detection. The proposed VNF presents auto‐scaling properties and is empirically shown to be able to process up to 5 million messages per second.…”

Section: Related Workmentioning

confidence: 99%

“…SPE's have been applied to sensor networks, the analysis of TCP flows, network intrusion detection . Multiple, diverse strategies for traffic anomaly detection have been proposed: machine learning, expert systems, rule mining, NFV technology, besides the strategy implemented in the present work which is the usage of entropy and PCA to detect traffic anomalies by monitoring the network traffic as a whole . It is possible to say that the major contribution of the present work is to employ an SPE extended with the operators to compute traffic entropy and PCA of the network as a whole in real time.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Duarte

Hara

Torres

et al. 2020

Security and Privacy

View full text Add to dashboard Cite

BackStreamDB is distributed traffic monitoring system based on a stream processing engine (SPE) designed to monitor the traffic of wide area backbones.BackStreamDB provides arbitrary metrics about the traffic in real time, taking into account the backbone as a whole. The system was developed for and successfully deployed on the Brazilian National Academic Network (RNP). In this work, we describe the functionality for the detection of traffic anomalies. A large number of Internet attacks are continuously reported, and several types of attacks result in anomalous traffic. In the proposed strategy for anomaly detection, the traffic is sampled by monitors that are distributed across the backbone, which are accessed and processed by the SPE. BackStreamDB was extended with stream processing modules for computing traffic entropy and principal component analysis, which are the employed to detect traffic anomalies. Experimental results are reported which were obtained to validate the effectiveness of the proposed strategy for different types of attacks.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Duarte

Hara

Torres

et al. 2020

Security and Privacy

View full text Add to dashboard Cite

show abstract

“…Beyond the autonomics domain, the intrusion detection/prevention through the usage of Virtual Network Functions (VNF) is a hot topic nowadays. Thereby, virtualized network nodes and functions are distributed across the network infrastructure and equipped with the belonging intelligence and logic as to automatically and collaboratively monitor, identify and block network attacks and anomalies [27] [28]. [29] proposes a framework for the trusted and authorized distribution of shortlived VNF based firewalls in a distributed network infrastructure.…”

Section: Related Workmentioning

confidence: 99%

Industrial Grade Methodology for Firewall Simulation and Requirements Verification

Barakat

Catal

Tcholtchev

et al. 2020

NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

Firewalls are a critical part in any security framework.Most firewalls consist of a large amount of sequential rules that are unstructured and confusing. Unfortunately, because a lot of rules configuration work is done manually by the network administrators, misconfigurations are very common and can affect the reliability of the firewall. Identifying such anomalies is a challenging task. In this paper, we propose a tree based simulation and verification model to verify if the implemented firewall of a system is in compliance with the belonging firewall requirements. The proposed methodology was developed in relation with the H2020 FORTIKA project and was evaluated in the scope of case studies with industrial partners. The case studies in question related to large scale telecom infrastructures involving critical scenarios in the scope of Smart Cities in general and SME cyber-security protection. Thereby, the executed case studies demonstrate how our approach can lead to improved structuring of firewalls and belonging rules, to the comfortable visualization of firewall structures and decision patterns, and finally to the verification of system and context requirements imposed by the firewall operation environment.

show abstract

“…In a previous work, we evaluated the performance of our monitoring system as a virtual network function. Results show that our virtual network function can scale and migrate during traffic overload.…”

Section: Introductionmentioning

confidence: 99%

Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data

Lopez

Mattos

Duarte

et al. 2019

Concurrency and Computation

Self Cite

View full text Add to dashboard Cite

The late detection of security threats causes a significant increase in the risk of irreparable damages and restricts any defense attempt. In this paper, we propose a sCAlable TRAffic Classifier and Analyzer (CATRACA). CATRACA works as an efficient online Intrusion Detection and Prevention System implemented as a Virtualized Network Function. CATRACA is based on Apache Spark, a Big Data Streaming processing system, and it is deployed over the Open Platform for Network Functions Virtualization (OPNFV), providing an accurate real-time threat-detection service. The system presents a friendly graphical interface that provides real-time visualization of the traffic and the attacks that occur in the network. Our prototype can differentiate normal traffic from denial of service (DoS) attacks and vulnerability probes over 95% accuracy under three different datasets. Moreover, CATRACA handles streaming data under concept drift detection with more than 85% of accuracy. KEYWORDSbig data, network traffic classification, stream processing, threat detection, virtual network function INTRODUCTIONThe Internet is facing constant changes, from the diversity of the user, the complexity of its application, until the heterogeneity of the information producers. 1 As a consequence, traffic monitoring, a critical task in maintaining the stability, reliability, and security of computer networks, is facing new challenges. 2 Current network monitoring tools are inadequate for current speed and management needs of large network domains.To ensure network security, new systems must be designed since current security systems such as Security Information and Event Management (SIEM) are inadequate. While 82% of security threats occur in minutes, an intrusion can take up to 8 months to be detected. 3 It is essential that the detection time is the least possible so that intrusion prevention can be effective. 4Security incidents have increased their complexity, and simple analysis and filtering of packets are no longer sufficient. Attackers try to hide malicious traffic from the security tools by forging the source IP and dynamically changing TCP port. In this context, a promising alternative for classifying network traffic and detect threats is to apply Machine Learning (ML) techniques. These techniques are suitable for big data, with more samples to train the classifier, as methods have higher effectiveness. 5 With a large number of features, however, ML techniques perform results with high latency due to computational resource consumption. This high latency is a disadvantage for applications that use machine learning for real-time classification. For example, network monitoring applications must analyze data and detect threats as quickly as possible. In this context, real-time stream processing allows the immediate analysis of different types of data and consequently benefits traffic monitoring for security threat detection. Open source distributed processing platforms such as Apache Storm, 6 Apache Flink, 7 and Apache Spark 8 process big data w...

show abstract

An evaluation of a virtual network function for real-time threat detection using stream processing

Cited by 15 publications

References 13 publications

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Industrial Grade Methodology for Firewall Simulation and Requirements Verification

Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data

Contact Info

Product

Resources

About