Efficient Learning of Communication Profiles from IP Flow Records

Christian Hammerschmidt, Samuel Marchal, Radu State, Nino Pellegrino, Sicco Verwer

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

11 Citations (Scopus)
36 Downloads (Pure)

Abstract

The task of network traffic monitoring has evolved drastically with the ever-increasing amount of data flowing in large scale networks. The automated analysis of this tremendous source of information often comes with using simpler models on aggregated data (e.g. IP flow records) due to time and space constraints. A step towards utilizing IP flow records more effectively are stream learning techniques. We propose a method to collect a limited yet relevant amount of data in order to learn a class of complex models, finite state machines, in real-time. These machines are used as communication profiles to fingerprint, identify or classify hosts and services and offer high detection rates while requiring less training data and thus being faster to compute than simple models.
Original languageEnglish
Title of host publicationProceedings - 2016 IEEE 41st Conference on Local Computer Networks, LCN 2016
EditorsPatrick Kellenberger
Place of PublicationLos Alamitos, CA
PublisherIEEE
Pages1-4
Number of pages4
ISBN (Electronic)978-1-5090-2054-6
DOIs
Publication statusPublished - 2016
Event2016 IEEE 41st Conference on Local Computer Networks, LCN 2016 - Dubai, United Arab Emirates
Duration: 7 Nov 201610 Nov 2016

Conference

Conference2016 IEEE 41st Conference on Local Computer Networks, LCN 2016
Country/TerritoryUnited Arab Emirates
CityDubai
Period7/11/1610/11/16

Bibliographical note

Accepted author manuscript

Keywords

  • machine learning
  • ip flow analysis
  • netflow
  • communication profiling
  • botnet detection
  • intrusion detection

Fingerprint

Dive into the research topics of 'Efficient Learning of Communication Profiles from IP Flow Records'. Together they form a unique fingerprint.

Cite this