Characterizing network traffic by means of the NetMine framework

Apiletti, Daniele; Baralis, Elena; Cerquitelli, Tania; D’Elia, Vincenzo

doi:10.1016/j.comnet.2008.12.011

Cited by 32 publications

(33 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…NetMine is a data mining application that specializes in understanding traffic data correlations and interactions [26]. While implementing methodologies similar to the ones used in this research effort, these studies focused on feature generation to improve traffic quality and network stability rather than network security.…”

Section: Network Telemetrymentioning

confidence: 99%

Industrial Control System Network Intrusion Detection by Telemetry Analysis

Ponomarev

Atkison

2016

IEEE Trans. Dependable and Secure Comput.

125

View full text Add to dashboard Cite

Until recently, Industrial Control Systems (ICSs) used "air-gap" security measures, where every node of the ICS network was isolated from other networks, including the Internet, by a physical disconnect. Attaching ICS networks to the Internet benefits companies and engineers who use them. However, as these systems were designed for use in the air-gapped security environment, protocols used by ICSs contain little to no security features and are vulnerable to various attacks. This paper proposes an approach to detect the intrusions into network attached ICSs by measuring and verifying data that is transmitted through the network but is not inherently the data used by the transmission protocol -network telemetry. Using simulated PLC units, the developed IDS was able to achieve 94.3% accuracy when differentiating between machines of an attacker and engineer on the same network, and 99.5% accuracy when differentiating between attacker and engineer on the Internet. Stanislav Ponomarev is a Ph.D. candidate of engineering at Louisiana Tech University with concentration in cyber security. His research topics of interest include image enhancement, hard drive forensics, malicious application detection, network intrusion detection, and windows executable memory attacks.Travis Atkison received the B.

show abstract

Section: Network Telemetrymentioning

confidence: 99%

Industrial Control System Network Intrusion Detection by Telemetry Analysis

Ponomarev

Atkison

2016

IEEE Trans. Dependable and Secure Comput.

125

View full text Add to dashboard Cite

show abstract

“…NetMine is a data mining type application that specializes in understanding traffic data correlations and interactions [1]. While implementing methodologies similar to the ones used in this research effort, these studies focused on feature generation to improve traffic quality, and network stability rather then network security.…”

Section: Introductionmentioning

confidence: 99%

Detection of SSH host spoofing in control systems through network telemetry analysis

Ponomarev

Wallace

Atkison

2014

Proceedings of the 9th Annual Cyber and Information Security Research Conference on - CISR '14

View full text Add to dashboard Cite

Modern networking architecture is designed with high scalability in mind. Different protocols can be encapsulated to support different systems. Machine identifiers (IP and MAC addresses) in network packets can be modified easily. This modification prevents servers from determining whether the connecting machines are allowed to communicate. Cryptographic functions have been used in protocols such as Secure Shell (SSH) to establish network node authenticity, but they can be circumvented by social engineering and brute force attacks. This research effort created a new classifier that processes network telemetry to determine authenticity of SSH clients in a control system's network. The developed classifier, within the control system's network, was able to differentiate with a 100% accuracy SSH connections from machines that were transmitting identical MAC and IP addresses, and had the same RSA key for authentication.

show abstract

“…A significant research effort has been devoted to the application of data mining techniques to network traffic analysis. The proposed approaches address the discovery of significant correlations among data [1], [2], the extraction of kowledge useful for prediction [3], and the clustering of network data with similar properties [4]. However, due to the continuous growth in network speed, petabytes of data may be transferred through a network every day.…”

Section: Introductionmentioning

confidence: 99%

NEMICO: Mining Network Data through Cloud-Based Data Mining Techniques

Baralis

Cagliero

Cerquitelli

et al. 2014

2014 IEEE/ACM 7th International Conference on Utility and Cloud Computing

Self Cite

View full text Add to dashboard Cite

Thanks to the rapid advances in Internet-based applications, data acquisition and storage technologies, petabytesized network data collections are becoming more and more common, thus prompting the need for scalable data analysis solutions. By leveraging today's ubiquitous many-core computer architectures and the increasingly popular cloud computing paradigm, the applicability of data mining algorithms to these large volumes of network data can be scaled up to gain interesting insights. This paper proposes NEMICO, a comprehensive Big Data mining system targeted to network traffic flow analyses (e.g., traffic flow characterization, anomaly detection, multiplelevel pattern mining). NEMICO comprises new approaches that contribute to a paradigm-shift in distributed data mining by addressing most challenging issues related to Big Data, such as data sparsity, horizontal scaling, and parallel computation.

show abstract

Characterizing network traffic by means of the NetMine framework

Cited by 32 publications

References 19 publications

Industrial Control System Network Intrusion Detection by Telemetry Analysis

Industrial Control System Network Intrusion Detection by Telemetry Analysis

Detection of SSH host spoofing in control systems through network telemetry analysis

NEMICO: Mining Network Data through Cloud-Based Data Mining Techniques

Contact Info

Product

Resources

About