Impact of Virtual Networks on Anomaly Detection with Machine Learning

Abstract

The enormous number of network packets transferred in modern networks together with the high-speed transmissions hamper the implementation of successful IT security mechanisms. In addition to this, virtual networks create highly dynamic and flexible environments, which differ widely from well-known infrastructures of the past decade. Network forensic investigation aiming at the detection of covert channels, malware usage or anomaly detection is faced with new problems and gets a time-consuming, error-prone and complex process. Machine learning provides advanced techniques to perform this work faster with a lower error rate. Depending on the learning technique, algorithms work nearly without any necessary interaction to detect relevant events in the transferred network packets. Occurring changes are noticed and additional processes might be started. Current algorithms work well in static environments, but the highly-dynamic environments of virtual networks create additional events, which might irritate the anomaly detection algorithms. This paper analyses virtual network protocols like VXLAN, GRE and GENVE and their impact of the detection rate of anomalies in the environment. Our research shows the need for adapted pre-processing of the network data, in the worst case on demand if changes are detected.

Encapcap: Transforming Network Traces to Virtual Networks

“…With the evolution of virtual network protocols a flexible and dynamic connection of network devices got possible. Whereas VLAN as the first implementation of such a protocol allows the use of 4096 different logical subnets 1 , modern implementations like Virtual eXtensible LAN (VXLAN), Generic Networking Virtualization Encapsulation (GENEVE) or Network Virtualization using Generic Routing Encapsulation (NVGRE) facilitate more than 16.000.000 different subnets 2 . The separation of the different networks is done with a special field in the header, which identifies an isolated subnet under the administration of a single customer.…”

“…The generation of network packets is defined as the result of time-stamped series of packets arriving and departing from particular network interfaces with realistic values [14]. This process is performed in various disciplines like IT-security [15], network troubleshooting [16], educational and training [17], [18], testing [19] and network forensic investigation [2], [20]. The generated network captures provide a valid way to repeat different tasks in order to train, simulate, troubleshoot or learn from the results.…”

“…Whereas anomaly detection is part of unsupervised learning, the analysis of the novelty is part of supervised learning. As shown in [2], virtual networks have an impact on the detection of anomalies, because the changes in the network might confuse the algorithms. Therefore, the models have to be trained again to learn aspects of virtual networks and their inherent dynamic [30].…”

“…The training of these algorithms is based on captured network data of the productive network. As shown in [2], changes inside virtual networks have an impact on the detection rate of the algorithms. Therefore, possible changes in the infrastructure demand for a new training of the model, based on new data.…”

“…Size of tag-field of VLAN is 12 byte, which led to 2 1 2 = 2096 values 2. The protocols use a 24 bit sized header field, which creates 2 2 4 = 16.777.215 subnets.…”