Feature Extraction and Visualization for Network PcapNg Traces

Velea, Radu; Ciobanu, Casian; Gurzau, Florina; Patriciu, Victor-Valeriu

doi:10.1109/cscs.2017.49

Cited by 5 publications

(3 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Le et al leverage the PCAPNG file format in AntMonitor, a system for monitoring mobile devices, to attach mobile application names to raw packets [40]. Velea et al also leverage the PCAPNG traffic capture format to encode pre-processed feature information, such as the use of encryption, the protocol, and the number of packets in a flow using a custom-developed block option [82,83]. In contrast to these works, our work focuses on building a generalizable system for network traffic analysis tasks by encoding arbitrary metadata onto packets.…”

Section: Related Workmentioning

confidence: 99%

Towards Reproducible Network Traffic Analysis

Holland¹,

Schmitt²,

Mittal³

et al. 2022

Preprint

View full text Add to dashboard Cite

Analysis techniques are critical for gaining insight into network traffic given both the higher proportion of encrypted traffic and increasing data rates. Unfortunately, the domain of network traffic analysis suffers from a lack of standardization, leading to incomparable results and barriers to reproducibility. Unlike other disciplines, no standard dataset format exists, forcing researchers and practitioners to create bespoke analysis pipelines for each individual task. Without standardization researchers cannot compare "applesto-apples," preventing us from knowing with certainty if a new technique represents a methodological advancement or if it simply benefits from a different interpretation of a given dataset.In this work, we examine irreproducibility that arises from the lack of standardization in network traffic analysis. First, we study the literature, highlighting evidence of irreproducible research based on different interpretations of popular public datasets. Next, we investigate the underlying issues that have lead to the status quo and prevent reproducible research. Third, we outline the standardization requirements that any solution aiming to fix reproducibility issues must address. We then introduce pcapML, an open source system which increases reproducibility of network traffic analysis research by enabling metadata information to be directly encoded into raw traffic captures in a generic manner. Finally, we use the standardization pcapML provides to create the pcapML benchmarks, an open source leaderboard website and repository built to track the progress of network traffic analysis methods.

show abstract

Section: Related Workmentioning

confidence: 99%

Towards Reproducible Network Traffic Analysis

Holland¹,

Schmitt²,

Mittal³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…There are some solutions published on network anomaly detection techniques [9], including studies incorporating machine learning in their solutions. There are also such studies that focus on anomaly detection in big-data related domains [10], [11]. In recent studies, many different techniques studied to solve the traffic classification problem.…”

Section: Related Workmentioning

confidence: 99%

An Intelligent and Time-Efficient DDoS Identification Framework for Real-Time Enterprise Networks: SAD-F: Spark Based Anomaly Detection Framework

et al. 2020

View full text Add to dashboard Cite

“…There are some notable solutions published on network anomaly detection techniques [9],including studies incorporating machine learning in their solutions. There are also such studies that focus on anomaly detection in big-data related domains [10], [11]. In recent studies, many different techniques have been studied to solve the traffic classification problem.…”

Section: Related Workmentioning

confidence: 99%

An Intelligent and Time-Efficient DDoS Identification Framework for Real-Time Enterprise Networks SAD-F: Spark Based Anomaly Detection Framework

Ahmed¹,

Hameed²,

Rafi³

et al. 2020

Preprint

View full text Add to dashboard Cite

Enterprise networks face a magnitude of threats that are managed and mitigated with a combination of proprietary and third-party security tools and services. However, the techniques and principles employed by the said tools, techniques and services are quite conventional and lack the rapid evolution, as required to protect against modern, state-of-the-art threats faced, specifically, against distributed denial of service (DDoS) attacks. The lack of efficiency of a network is directly proportional to the number of applications and services it hosts, particularly to protect against external and internal threats. Moreover, the effectiveness of such security mechanisms relies on their independent and proactive approach, which is only as effective as their knowledge of known malware and their attack vectors that becomes obsolete when there is a new malware or a zero-day vulnerability is exploited.This paper presents an intelligent, highly responsive, and scalable security framework for enterprise networks. The proposed framework incorporates Apache Spark Framework for security analytics and accurately identifies anomalies specifically pertaining to DDoS attacks from real-time network traffic by using customised machine learning algorithms meticulously trained against selected feature-set. The results are tested against different scenarios and bench-marked with the results achieved by related studies in similar scenarios.

show abstract

Feature Extraction and Visualization for Network PcapNg Traces

Cited by 5 publications

References 15 publications

Towards Reproducible Network Traffic Analysis

Towards Reproducible Network Traffic Analysis

An Intelligent and Time-Efficient DDoS Identification Framework for Real-Time Enterprise Networks: SAD-F: Spark Based Anomaly Detection Framework

An Intelligent and Time-Efficient DDoS Identification Framework for Real-Time Enterprise Networks SAD-F: Spark Based Anomaly Detection Framework

Contact Info

Product

Resources

About