Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models

Area of Science:

• Cybersecurity
• Machine Learning
• Network Traffic Analysis

Background:

• Advanced persistent threats (APTs) pose significant cybersecurity risks.
• Network attacks are a common method used by APTs to gain initial access.
• A lack of suitable network flow datasets hinders the development of effective machine learning detection models.

Purpose of the Study:

• To present a framework for gathering network flow datasets.
• To introduce DOROTHEA, a Docker-based tool for generating taggable network traffic.
• To enable the creation of datasets for training malicious traffic classification models.

Main Methods:

• A NetFlow sensor-based framework was designed for data collection.
• DOROTHEA was developed as a Dockerized solution to implement the framework.
• The generated datasets were used with the model evaluator (MoEv) to train machine learning models.

Main Results:

• Datasets generated using DOROTHEA were successfully used to train classification models.
• Four machine learning models achieved detection rates exceeding 93% for malicious traffic.
• The experiments validated the utility of DOROTHEA-generated datasets.

Conclusions:

• DOROTHEA provides a practical solution for generating network flow datasets.
• The generated datasets are effective for training machine learning models for APT detection.
• This work facilitates the development of more robust cybersecurity defenses against network-based threats.