Efficient Learning of Communication Profiles from IP Flow Records

Conference Paper (2016)
Author(s)

Christian Hammerschmidt (Université du Luxembourg)

Samuel Marchal (Aalto University)

Radu State (Université du Luxembourg)

Nino Pellegrino (TU Delft - Cyber Security)

Sicco Verwer (TU Delft - Cyber Security)

Research Group
Cyber Security
Copyright
© 2016 C.A. Hammerschmidt, Samuel Marchal, Radu State, G. Pellegrino, S.E. Verwer
DOI related publication
https://doi.org/10.1109/LCN.2016.92
More Info
expand_more
Publication Year
2016
Language
English
Copyright
© 2016 C.A. Hammerschmidt, Samuel Marchal, Radu State, G. Pellegrino, S.E. Verwer
Research Group
Cyber Security
Bibliographical Note
Accepted author manuscript@en
Pages (from-to)
1-4
ISBN (electronic)
978-1-5090-2054-6
Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Abstract

The task of network traffic monitoring has evolved drastically with the ever-increasing amount of data flowing in large scale networks. The automated analysis of this tremendous source of information often comes with using simpler models on aggregated data (e.g. IP flow records) due to time and space constraints. A step towards utilizing IP flow records more effectively are stream learning techniques. We propose a method to collect a limited yet relevant amount of data in order to learn a class of complex models, finite state machines, in real-time. These machines are used as communication profiles to fingerprint, identify or classify hosts and services and offer high detection rates while requiring less training data and thus being faster to compute than simple models.

Files

License info not available