Analysis of NetFlow Features’ Importance in Malicious Network Traffic Detection

Campazas-Vega, Adrián; Crespo-Martínez, Ignacio Samuel; Guerrero‐Higueras, Ángel Manuel; Álvarez-Aparicio, Claudia; Olivera, Vicente Matellán

doi:10.1007/978-3-030-87872-6_6

Cited by 4 publications

(2 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These advantages make them suitable candidates for the most restricted configurations. Also, given the current trend towards flow level monitors like NetFlow [157], the ability to operate on statistical characteristics only is an advantageous property for classifiers.…”

Section: Discussion and Open Issues A Discussionmentioning

confidence: 99%

A Complete Review on the Application of Statistical Methods for Evaluating Internet Traffic Usage

et al. 2022

View full text Add to dashboard Cite

Internet traffic classification aims to identify the kind of Internet traffic. With the rise of traffic encryption and multi-layer data encapsulation, some classic classification methods have lost their strength. In an attempt to increase classification performance, Machine Learning (ML) strategies have gained the scientific community interest and have shown themselves promising in the future of traffic classification, mainly in the recognition of encrypted traffic. However, some of these methods have a high computational resource consumption, which make them unfeasible for classification of large traffic flows or in real-time. Methods using statistical analysis have been used to classify real-time traffic or large traffic flows, where the main objective is to find statistical differences among flows or find a pattern in traffic characteristics through statistical properties that allow traffic classification. The purpose of this work is to address statistical methods to classify Internet traffic that were little or unexplored in the literature. This work is not generally focused on discussing statistical methodology. It focuses on discussing statistical tools applied to Internet traffic classification Thus, we provide an overview on statistical distances and divergences previously used or with potential to be used in the classification of Internet traffic. Then, we review previous works about Internet traffic classification using statistical methods, namely Euclidean, Bhattacharyya, and Hellinger distances, Jensen-Shannon and Kullback-Leibler (KL) divergences, Support Vector Machines (SVM), Correlation Information (Pearson Correlation), Kolmogorov-Smirnov and Chi-Square tests, and Entropy. We also discuss some open issues and future research directions on Internet traffic classification using statistical methods.

show abstract

Section: Discussion and Open Issues A Discussionmentioning

confidence: 99%

A Complete Review on the Application of Statistical Methods for Evaluating Internet Traffic Usage

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Additionally, time-related features such as 'unix secs', 'unix nsecs','sysuptime', 'first', and 'last' have been excluded to prevent model bias based on the time of data collection. [17] Finally, the 'nexthop' feature has been eliminated as it adversely impacts the detection of malicious traffic in wide area networks, necessitating its removal during the machine learning model training phase [18].…”

Section: Data Processingmentioning

confidence: 99%

Enhanced Network Security against SQL Injection Attack Using Machine Learning

Joshi,

Oza

2024

Preprint

View full text Add to dashboard Cite

SQL injection attacks pose a significant risk to the security of computer networks. These attacks have the potential to gain unauthorized access to sensitive data, modify or remove data, or even render entire websites and databases inoperable. Conventional techniques for identifying and stopping SQL injection attacks are frequently resource-intensive, rendering them unfeasible for devices that manage substantial amounts of traffic. The objective of the proposed research is to improve the identification and prevention of structured query language injection attacks (SQLIAs) in web applications, with a specific focus on attaining a high rate of detection while minimizing false alarms. We utilized flow data obtained from several SQL injection attack scenarios that specifically targeted widely-used database engines. We obtained a high level of accuracy in identifying and mitigating these assaults by utilizing machine learning methods, specifically logistic regression. The method we used showed a detection rate over 98% and a false alarm rate below 0.029%. The results demonstrate substantial enhancements in the prevention of unauthorized access and the protection of sensitive information within databases. The results of our research align with or surpass current techniques, offering enhanced security for web applications. The model’s exceptional accuracy and minimal false alarm rate provide a groundbreaking method for detecting SQL injection attacks.

show abstract