A survey on deep packet inspection

El-Maghraby, Reham Taher; Elazim, Nada Mostafa Abd; Bahaa-Eldin, Ayman M.

doi:10.1109/icces.2017.8275301

Cited by 45 publications

(13 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The payload-based traffic detection method [5], [6] uses the information of the application layer protocol to express the features of the traffic, the most representative of which is the deep packet inspection (DPI) technology [7]. Deep packet inspection technology needs to decrypt and encrypt the transmitted traffic data.…”

Section: Introductionmentioning

confidence: 99%

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

et al. 2019

View full text Add to dashboard Cite

Network intrusion detection plays a very important role in protecting computer network security. The abnormal traffic detection and analysis by extracting the statistical features of flow is the main analysis method in the field of network intrusion detection. However, these features need to be designed and extracted manually, which often loses the original information of the flow and leads to poor detection efficiency. In this paper, we do not manually design the features of the flow but directly extract the raw data information of the flow for analysis. In addition, we first proposed a new network intrusion detection model named the deep hierarchical network, which integrates the improved LeNet-5 and LSTM neural network structures, while learning the spatial and temporal features of flow. By designing a reasonable network cascading method, we can train our proposed hierarchical network at the same time instead of training two networks separately. In this paper, we use the CICIDS2017 dataset and the CTU dataset. The number and types of flow in these two datasets are large, and the attack types are relatively new. The experimental results show that the performance of the proposed hierarchical network model is significantly better than other network intrusion detection models, which can achieve the best detection accuracy. Finally, we also present an analysis method for traffic features which has an important contribution to abnormal traffic detection and gives the actual meanings of these important features. INDEX TERMS Network intrusion detection, deep hierarchical network, raw feature, feature importance.

show abstract

Section: Introductionmentioning

confidence: 99%

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

et al. 2019

View full text Add to dashboard Cite

show abstract

“…The survey [60] gives a brief idea about challenges in DPI and some of the design objectives and then briefly explains different matching algorithms and their limitations. At the end, some of the most popular techniques using DPI are outlined.…”

Section: Related Research On Network Traffic Analysis and Anomaly Detmentioning

confidence: 99%

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Song

Beshley

Przystupa

et al. 2020

Sensors

View full text Add to dashboard Cite

In this paper, to solve the problem of detecting network anomalies, a method of forming a set of informative features formalizing the normal and anomalous behavior of the system on the basis of evaluating the Hurst (H) parameter of the network traffic has been proposed. Criteria to detect and prevent various types of network anomalies using the Three Sigma Rule and Hurst parameter have been defined. A rescaled range (RS) method to evaluate the Hurst parameter has been chosen. The practical value of the proposed method is conditioned by a set of the following factors: low time spent on calculations, short time required for monitoring, the possibility of self-training, as well as the possibility of observing a wide range of traffic types. For new DPI (Deep Packet Inspection) system implementation, algorithms for analyzing and captured traffic with protocol detection and determining statistical load parameters have been developed. In addition, algorithms that are responsible for flow regulation to ensure the QoS (Quality of Services) based on the conducted static analysis of flows and the proposed method of detection of anomalies using the parameter Hurst have been developed. We compared the proposed software DPI system with the existing SolarWinds Deep Packet Inspection for the possibility of network traffic anomaly detection and prevention. The created software components of the proposed DPI system increase the efficiency of using standard intrusion detection and prevention systems by identifying and taking into account new non-standard factors and dependencies. The use of the developed system in the IoT communication infrastructure will increase the level of information security and significantly reduce the risks of its loss.

show abstract

“…[3,4]. Among them, packet-level traffic analysis is a common approach, wherein deep packet inspection (DPI) is an accepted conduct [8]. This approach requires the capturing and analysis of highly-detailed network traffic data including the payload of each packet.…”

Section: Netflow As a Basis For Privacy-preserving Traffic Analysismentioning

confidence: 99%

Privacy-Preserving Detection of IoT Devices Connected Behind a NAT in a Smart Home Setup

Sachidananda¹,

Elovici²,

Shabtai³

2019

Preprint

View full text Add to dashboard Cite

Today, telecommunication service providers (telcos) are exposed to cyber-attacks executed by compromised IoT devices connected to their customers' networks. Such attacks might have severe effects not only on the target of attacks but also on the telcos themselves. To mitigate those risks we propose a machine learning based method that can detect devices of specific vulnerable IoT models connected behind a domestic NAT, thereby identifying home networks that pose a risk to the telco's infrastructure and availability of services. As part of the effort to preserve the domestic customers' privacy, our method relies on NetFlow data solely, refraining from inspecting the payload. To promote future research in this domain we share our novel dataset, collected in our lab from numerous and various commercial IoT devices.

show abstract

A survey on deep packet inspection

Cited by 45 publications

References 24 publications

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection

Privacy-Preserving Detection of IoT Devices Connected Behind a NAT in a Smart Home Setup

Contact Info

Product

Resources

About