Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models

[EN] Advanced persistent threats (APTs) are a growing concern in cybersecurity. Many companies and governments have reported incidents related to these threats. Throughout the life cycle of an APT, one of the most commonly used techniques for gaining access is network attacks. Tools based on machine...

ver descrição completa

Detalhes bibliográficos
Autores: Campazas Vega, Adrián, Crespo Martínez, Ignacio Samuel, Guerrero Higueras, Ángel Manuel, Fernández Llamas, Camino
Formato: artículo
Estado:Versión publicada
Fecha de publicación:2020
País:España
Recursos:Universidad Rey Juan Carlos
Repositorio:BULERIA. Repositorio Institucional de la Universidad de León
OAI Identifier:oai:buleria.unileon.es:10612/19087
Acesso em linha:https://hdl.handle.net/10612/19087
Access Level:acceso abierto
Palavra-chave:Cibernética
Informática
NetFlow
Packet Flow
Advanced Persistent Threat
Malicious traffic
Dataset
1207.03 Cibernética
1203.17 Informática
id ES_4b3f1663f7c14c652c82a7f5029e7465
oai_identifier_str oai:buleria.unileon.es:10612/19087
network_acronym_str ES
network_name_str España
repository_id_str
spelling Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection ModelsCampazas Vega, AdriánCrespo Martínez, Ignacio SamuelGuerrero Higueras, Ángel ManuelFernández Llamas, CaminoCibernéticaInformáticaNetFlowPacket FlowAdvanced Persistent ThreatMalicious trafficDataset1207.03 Cibernética1203.17 Informática[EN] Advanced persistent threats (APTs) are a growing concern in cybersecurity. Many companies and governments have reported incidents related to these threats. Throughout the life cycle of an APT, one of the most commonly used techniques for gaining access is network attacks. Tools based on machine learning are effective in detecting these attacks. However, researchers usually have problems with finding suitable datasets for fitting their models. The problem is even harder when flow data are required. In this paper, we describe a framework to gather flow datasets using a NetFlow sensor. We also present the Docker-based framework for gathering netflow data (DOROTHEA), a Docker-based solution implementing the above framework. This tool aims to easily generate taggable network traffic to build suitable datasets for fitting classification models. In order to demonstrate that datasets gathered with DOROTHEA can be used for fitting classification models for malicious-traffic detection, several models were built using the model evaluator (MoEv), a general-purpose tool for training machine-learning algorithms. After carrying out the experiments, four models obtained detection rates higher than 93%, thus demonstrating the validity of the datasets gathered with the tool.SIInstituto Nacional de CiberseguridadMinisterio de Ciencia, Innovación y UniversidadesMDPIArquitectura y Tecnologia de ComputadoresEscuela de Ingenierias Industrial, Informática y Aeroespacial2020info:eu-repo/semantics/articleinfo:eu-repo/semantics/publishedVersionhttps://hdl.handle.net/10612/19087reponame:BULERIA. Repositorio Institucional de la Universidad de Leóninstname:Universidad Rey Juan CarlosInglésinfo:eu-repo/grantAgreement/AEI/Programa Programa Estatal de I+D+i Orientada a los Retos de la Sociedad/RTI2018-100683-B-100Instituto Nacional de Ciberseguridad de España (ADENDA 4: Detección de nuevas amenazas y patrones desconocidos (Red Regional de Ciencia y Tecnología)http://creativecommons.org/licenses/by/4.0/info:eu-repo/semantics/openAccessoai:buleria.unileon.es:10612/190872026-06-24T12:43:27Z
dc.title.none.fl_str_mv Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
title Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
spellingShingle Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
Campazas Vega, Adrián
Cibernética
Informática
NetFlow
Packet Flow
Advanced Persistent Threat
Malicious traffic
Dataset
1207.03 Cibernética
1203.17 Informática
title_short Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
title_full Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
title_fullStr Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
title_full_unstemmed Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
title_sort Flow-Data Gathering Using NetFlow Sensors for Fitting Malicious-Traffic Detection Models
dc.creator.none.fl_str_mv Campazas Vega, Adrián
Crespo Martínez, Ignacio Samuel
Guerrero Higueras, Ángel Manuel
Fernández Llamas, Camino
author Campazas Vega, Adrián
author_facet Campazas Vega, Adrián
Crespo Martínez, Ignacio Samuel
Guerrero Higueras, Ángel Manuel
Fernández Llamas, Camino
author_role author
author2 Crespo Martínez, Ignacio Samuel
Guerrero Higueras, Ángel Manuel
Fernández Llamas, Camino
author2_role author
author
author
dc.contributor.none.fl_str_mv Arquitectura y Tecnologia de Computadores
Escuela de Ingenierias Industrial, Informática y Aeroespacial
dc.subject.none.fl_str_mv Cibernética
Informática
NetFlow
Packet Flow
Advanced Persistent Threat
Malicious traffic
Dataset
1207.03 Cibernética
1203.17 Informática
topic Cibernética
Informática
NetFlow
Packet Flow
Advanced Persistent Threat
Malicious traffic
Dataset
1207.03 Cibernética
1203.17 Informática
description [EN] Advanced persistent threats (APTs) are a growing concern in cybersecurity. Many companies and governments have reported incidents related to these threats. Throughout the life cycle of an APT, one of the most commonly used techniques for gaining access is network attacks. Tools based on machine learning are effective in detecting these attacks. However, researchers usually have problems with finding suitable datasets for fitting their models. The problem is even harder when flow data are required. In this paper, we describe a framework to gather flow datasets using a NetFlow sensor. We also present the Docker-based framework for gathering netflow data (DOROTHEA), a Docker-based solution implementing the above framework. This tool aims to easily generate taggable network traffic to build suitable datasets for fitting classification models. In order to demonstrate that datasets gathered with DOROTHEA can be used for fitting classification models for malicious-traffic detection, several models were built using the model evaluator (MoEv), a general-purpose tool for training machine-learning algorithms. After carrying out the experiments, four models obtained detection rates higher than 93%, thus demonstrating the validity of the datasets gathered with the tool.
publishDate 2020
dc.date.none.fl_str_mv 2020
dc.type.none.fl_str_mv info:eu-repo/semantics/article
info:eu-repo/semantics/publishedVersion
format article
status_str publishedVersion
dc.identifier.none.fl_str_mv https://hdl.handle.net/10612/19087
url https://hdl.handle.net/10612/19087
dc.language.none.fl_str_mv Inglés
language_invalid_str_mv Inglés
dc.relation.none.fl_str_mv info:eu-repo/grantAgreement/AEI/Programa Programa Estatal de I+D+i Orientada a los Retos de la Sociedad/RTI2018-100683-B-100
Instituto Nacional de Ciberseguridad de España (ADENDA 4: Detección de nuevas amenazas y patrones desconocidos (Red Regional de Ciencia y Tecnología)
dc.rights.none.fl_str_mv http://creativecommons.org/licenses/by/4.0/
info:eu-repo/semantics/openAccess
rights_invalid_str_mv http://creativecommons.org/licenses/by/4.0/
eu_rights_str_mv openAccess
dc.publisher.none.fl_str_mv MDPI
publisher.none.fl_str_mv MDPI
dc.source.none.fl_str_mv reponame:BULERIA. Repositorio Institucional de la Universidad de León
instname:Universidad Rey Juan Carlos
instname_str Universidad Rey Juan Carlos
reponame_str BULERIA. Repositorio Institucional de la Universidad de León
collection BULERIA. Repositorio Institucional de la Universidad de León
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869407547777089536
score 15,300724

Registos relacionados