IFS: Intelligent flow sampling for network security–an adaptive approach

Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F15%3A00230859" target="_blank" >RIV/68407700:21230/15:00230859 - isvavai.cz</a>
Result on the web
<a href="http://onlinelibrary.wiley.com/doi/10.1002/nem.1902/full" target="_blank" >http://onlinelibrary.wiley.com/doi/10.1002/nem.1902/full</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1002/nem.1902" target="_blank" >10.1002/nem.1902</a>

Result language
angličtina
Original language name
IFS: Intelligent flow sampling for network security–an adaptive approach
Original language description
In order to cope with an increasing volume of network traffic, flow sampling methods are deployed to reduce the volume of log data stored for monitoring, attack detection, and forensic purposes. Sampling frequently changes the statistical properties of the data and can reduce the effectiveness of subsequent analysis or processing. We propose two concepts that mitigate the negative impact of sampling on the data. Late sampling is based on a simple idea that the features used by the analytic algorithms can be extracted before the sampling and attached to the surviving flows. The surviving flows thus carry the representation of the original statistical distribution in these attached features. The second concept we introduce is that of adaptive sampling. Adaptive sampling deliberatively skews the distribution of the surviving data to overrepresent the rare flows or flows with rare feature values. This preserves the variability of the data and is critical for the analysis of malicious traffic, such as the detection of stealthy, hidden threats. Our approach has been extensively validated on standard NetFlow data, as well as on HTTP proxy logs that approximate the use-case of enriched IPFIX for the network forensics.
Czech name
—
Czech description
—

Type
J<sub>x</sub> - Unclassified - Peer-reviewed scientific article (Jimp, Jsc and Jost)
CEP classification
JC - Computer hardware and software
OECD FORD branch
—

Project
<a href="/en/project/VG20122014079" target="_blank" >VG20122014079: Behavioral Detection of Advanced Persistent Threats in Computer Networks</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year
2015
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Similar results(10)