Real-time Pattern Detection in IP Flow Data using Apache Spark

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F19%3A00108993" target="_blank" >RIV/00216224:14610/19:00108993 - isvavai.cz</a>

Result on the web

<a href="http://dl.ifip.org/db/conf/im/im2019mini/189431.pdf" target="_blank" >http://dl.ifip.org/db/conf/im/im2019mini/189431.pdf</a>

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

Real-time Pattern Detection in IP Flow Data using Apache Spark

Original language description

Detection of network attacks is a challenging task, especially concerning detection coverage and timeliness. The defenders need to be able to detect advanced types of attacks and minimize the time gap between the attack detection and its mitigation. To meet these requirements, we present a stream-based IP flow data processing application for real-time attack detection using similarity search techniques. Our approach extends capabilities of traditional detection systems and allows to detect not only anomalies and attacks that match exactly to predefined patterns but also their variations. The approach is demonstrated on detection of SSH authentication attacks. We describe a process of patterns definition and illustrate their usage in a real-world deployment. We show that our approach provides sufficient performance of IP flow data processing for real-time detection while maintaining versatility and ability to detect network attacks that have not been recognized by traditional approaches.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: CyberSecurity, CyberCrime and Critical Information Infrastructures Center of Excellence</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2019

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)

ISBN

9781728106182

ISSN

1573-0077

e-ISSN

—

Number of pages

6

Pages from-to

521-526

Publisher name

IEEE

Place of publication

Washington DC, USA

Event location

Washington DC, USA

Event date

Jan 1, 2019

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

000469937200092