Intelligent Sampling Using an Optimized Neural Network

Abstract

Modern Internet has enabled wider usage, resulting in increased network traffic. Due to the high volume of data packets in networking, sampling techniques are widely used in flow-based network management software to manage traffic load. However, sampling processes reduce the likelihood of anomaly detection. Many studies have been carried out at improving the accuracy of anomaly detection. However, only a few studies have considered it with sampled flow traffic. In our study, we investigate the use of an artificial neural network (ANN)based classifier to improve the accuracy of flow-based anomaly detection in sampled traffic. A feedback from the ANN-based anomaly detector determines the type of the flow sampling method that should be used. Our proposed technique handles malicious flows and benign flows with different sampling methods. To evaluate the proposed sampling technique, a number of flow-based datasets are generated. Our experiments confirm that the proposed technique improves the percentage of the sampled malicious flows by about 7% and it can preserve the majority of traffic information.

Automated detection-in-depth in industrial control systems

“…NetFlow-based analysis can be used to detect cyber-attacks which affect the volume of network traffic. This method is capable of detecting attacks like port scanning, DNS Poisoning, DoS, and DDoS attacks [6,7,29,30]. The lack of payload analysis makes the NetFlow-based methods scalable, fast and cost-effective for anomaly detection [41].…”

“…NetFlow is a Cisco proprietary protocol, which can be enabled on router devices, to provide NetFlow records. A NetFlow record is defined as a group of packets with some common characteristics which pass a monitoring point in a specific time interval [6,8,9]. Compared with payload-based methods, a NetFlow-based analysis method significantly reduces the volume of traffic to be processed.…”

“…Despite packet-based analysis, NetFlow-based methods process only packet headers and they provide light-weight analysis. The efficiency of NetFlow-based anomaly detection is illustrated in IT networks [6][7][8]46]. However, it has not been investigated in an ICS environment.…”