Flow Aggregation for the IP Flow Information Export (IPFIX) Protocol

Trammell, Brian; Wagner, Arno; Claise, Benoît

doi:10.17487/rfc7015

Cited by 66 publications

(11 citation statements)

References 15 publications

(6 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Flows are analyzed within fixed time intervals (every 5 min by default). Bidirectional flows [96] are used since, according to some works (e.g. [8]), unidirectional flows may entail biased results.…”

Section: Architecturementioning

confidence: 99%

An Entropy-Based Network Anomaly Detection Method

Bereziński

Jasiul

Szpyrka

2015

Entropy

157

View full text Add to dashboard Cite

Data mining is an interdisciplinary subfield of computer science involving methods at the intersection of artificial intelligence, machine learning and statistics. One of the data mining tasks is anomaly detection which is the analysis of large quantities of data to identify items, events or observations which do not conform to an expected pattern. Anomaly detection is applicable in a variety of domains, e.g., fraud detection, fault detection, system health monitoring but this article focuses on application of anomaly detection in the field of network intrusion detection.The main goal of the article is to prove that an entropy-based approach is suitable to detect modern botnet-like malware based on anomalous patterns in network. This aim is achieved by realization of the following points: (i) preparation of a concept of original entropy-based network anomaly detection method, (ii) implementation of the method, (iii) preparation of original dataset, (iv) evaluation of the method.

show abstract

Section: Architecturementioning

confidence: 99%

An Entropy-Based Network Anomaly Detection Method

Bereziński

Jasiul

Szpyrka

2015

Entropy

157

View full text Add to dashboard Cite

show abstract

“…Such patterns typically include source and destination IP addresses, port numbers, timestamps and transmission duration, as well as the amount of data and number of packets sent. Flow monitoring systems like compatible IOS routers usually export Netflow [29] or IPFIX [144] records and transmit them to a central node for analysis.…”

Section: Network Domainmentioning

confidence: 99%

Semantics-aware detection of targeted attacks: a survey

Luh

Marschalek

Kaiser

et al. 2016

J Comput Virol Hack Tech

View full text Add to dashboard Cite

In today's interconnected digital world, targeted attacks have become a serious threat to conventional computer systems and critical infrastructure alike. Many researchers contribute to the fight against network intrusions or malicious software by proposing novel detection systems or analysis methods. However, few of these solutions have a particular focus on Advanced Persistent Threats or similarly sophisticated multi-stage attacks. This turns finding domainappropriate methodologies or developing new approaches into a major research challenge. To overcome these obstacles, we present a structured review of semantics-aware works that have a high potential for contributing to the analysis or detection of targeted attacks. We introduce a detailed literature evaluation schema in addition to a highly granular model for article categorization. Out of 123 identified papers, 60 were found to be relevant in the context of this study. The selected articles are comprehensively reviewed and assessed in accordance to Kitchenham's guidelines for systematic literature reviews. In conclusion, we combine new insights and the status quo of current research into the concept of an ideal systemic approach capable of semantically processing and evaluating information from different observation points.

show abstract

“…For the purpose of the aggregation process there was a need to implement some information elements related to flow aggregation according to [14]. The implemented method was verified by preliminary measurements.…”

Section: Preliminary Experimentsmentioning

confidence: 99%

Reduction of IP flow information in network traffic monitoring systems

Tremko

Pekár

Juhár

et al. 2014

2014 IEEE 12th IEEE International Conference on Emerging eLearning Technologies and Applications (ICETA)

View full text Add to dashboard Cite

This paper deals with the design, implementation and evaluation of a method for the reduction of IP flow information. The aim of this method is to decrease the utilization of the measuring tools based on the IPFIX protocol. The designed method was implemented in the MyBeem component of the SLAmeter network traffic monitoring tool, which is used for measuring various network traffic characteristics. This method uses the values of the IP flow keys for decreasing the load of the monitoring system by reducing the number of flows sent from the Exporter(s) to the Collector(s). This technique focuses on aggregation by which the number of flows generated by the metering process is controlled. The main contribution of this paper is an IP flow information data reduction technique.

show abstract

Flow Aggregation for the IP Flow Information Export (IPFIX) Protocol

Abstract: This document provides a common implementation-independent basis for the interoperable application of the IP Flow

Cited by 66 publications

References 15 publications

An Entropy-Based Network Anomaly Detection Method

An Entropy-Based Network Anomaly Detection Method

Semantics-aware detection of targeted attacks: a survey

Reduction of IP flow information in network traffic monitoring systems

Contact Info

Product

Resources

About