Malicious traffic detection on sampled network flow data with novelty-detection-based models

Area of Science:

• Computer Science
• Cybersecurity
• Network Security

Background:

• Classical anomaly detection analyzes individual packets, which is infeasible for high-traffic routers.
• Routers use flow data for network statistics, but sampling is necessary due to computational costs, leading to information loss.
• Detecting cyber-attacks using sampled flow data remains a challenge.

Purpose of the Study:

• To demonstrate the feasibility of detecting malicious network traffic using anomaly detection on sampled flow data.
• To evaluate the performance of novelty-detection-based models on flow data with a sampling rate of 1 out of 1,000 packets.
• To assess the accuracy and false alarm rate of these models using both synthetic and real-world network data.

Main Methods:

• Utilized anomaly-detection-based models, specifically focusing on novelty detection.
• Employed synthetic sampled flow data and actual sampled flow data from the RedCAYLE network.
• Evaluated model performance based on accuracy and false alarm rates.

Main Results:

• Malicious network traffic can be successfully detected even when using flow data sampled at a rate of 1 out of 1,000 packets.
• Novelty-detection-based models achieved high accuracy in identifying malicious traffic within sampled flow data.
• The proposed approach demonstrated a low false alarm rate, indicating reliable detection.

Conclusions:

• Anomaly detection, particularly novelty detection, is effective for identifying cyber-attacks on sampled network flow data.
• The findings support the use of sampled flow data for cybersecurity threat detection in resource-constrained environments.
• This research validates that significant network security insights can be retained despite aggressive data sampling.