On the Impact of Flow Monitoring Configuration
Identifikátory výsledku
Kód výsledku v IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F20%3A00115554" target="_blank" >RIV/00216224:14610/20:00115554 - isvavai.cz</a>
Výsledek na webu
<a href="http://dx.doi.org/10.1109/NOMS47738.2020.9110361" target="_blank" >http://dx.doi.org/10.1109/NOMS47738.2020.9110361</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/NOMS47738.2020.9110361" target="_blank" >10.1109/NOMS47738.2020.9110361</a>
Alternativní jazyky
Jazyk výsledku
angličtina
Název v původním jazyce
On the Impact of Flow Monitoring Configuration
Popis výsledku v původním jazyce
Flow monitoring has become an essential source of information for intrusion detection systems and various forms of network data analytics. However, the attention of researchers is focused primarily on the utilisation of the flow data, and the process of flow data creation is often neglected. This lack of consideration negatively affects the results of data analytics. Either the results are suboptimal due to the low quality of the flow data, or a description of the configuration of the flow monitoring system is missing, which leads to irreproducible results. The goal of this paper is to demonstrate how the configuration of the flow monitoring system affects the resulting data. The most basic flow monitoring configuration variables are the flow expiration timeouts. We analyse their effect on the number of created flow records to show their importance. Moreover, we demonstrate that the choice of the flow expiration timeouts can have a severe impact on the network data analytics. The use-case of Slowloris attack detection is used as an example to illustrate this fact.
Název v anglickém jazyce
On the Impact of Flow Monitoring Configuration
Popis výsledku anglicky
Flow monitoring has become an essential source of information for intrusion detection systems and various forms of network data analytics. However, the attention of researchers is focused primarily on the utilisation of the flow data, and the process of flow data creation is often neglected. This lack of consideration negatively affects the results of data analytics. Either the results are suboptimal due to the low quality of the flow data, or a description of the configuration of the flow monitoring system is missing, which leads to irreproducible results. The goal of this paper is to demonstrate how the configuration of the flow monitoring system affects the resulting data. The most basic flow monitoring configuration variables are the flow expiration timeouts. We analyse their effect on the number of created flow records to show their importance. Moreover, we demonstrate that the choice of the flow expiration timeouts can have a severe impact on the network data analytics. The use-case of Slowloris attack detection is used as an example to illustrate this fact.
Klasifikace
Druh
D - Stať ve sborníku
CEP obor
—
OECD FORD obor
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Návaznosti výsledku
Projekt
<a href="/cs/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur</a><br>
Návaznosti
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Ostatní
Rok uplatnění
2020
Kód důvěrnosti údajů
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Údaje specifické pro druh výsledku
Název statě ve sborníku
2020 IEEE/IFIP Network Operations and Management Symposium (NOMS 2020)
ISBN
9781728149738
ISSN
2374-9709
e-ISSN
—
Počet stran výsledku
7
Strana od-do
1-7
Název nakladatele
IEEE Xplore Digital Library
Místo vydání
Budapešť
Místo konání akce
Budapešť
Datum konání akce
20. 4. 2020
Typ akce podle státní příslušnosti
WRD - Celosvětová akce
Kód UT WoS článku
—