Behavior-Aware Network Segmentation using IP Flows

Abstract

Network segmentation is a powerful tool for network defense. In contemporary complex, dynamic, and multilayer networks, network segmentation suffers from lack of visibility into processes in the network, which results in less strict segment definition and loosen network security. Moreover, the dynamics of the networks makes the manual identification of network segments nearly impossible. In this paper, we inspect the possibilities of the behavioraware network segmentation using IP flows and machine learning approaches that would enable to identify segments automatically, even in a complex network. We evaluate the suitability of clustering algorithms for identification of behavior-consistent segments in a network. We show that the clustering algorithms can identify relevant behavior-consistent clusters that overlap with those identified manually by experts. Apart from the segment identification, we investigate the other essential task of network segmentation process: assignment of an unknown host to an existing segment. We evaluate the performance of four different classification mechanisms on a real-world dataset. We show that it is possible to assign an unknown host to an appropriate network segment with up to 92% precision. Moreover, we release the whole dataset and experiment steps available for public use.

Untitled

“…More complicated roles may both be predefined or computed from observations. [4] models the behavior of the hosts of a university network and shows reasonable results to recover the network segmentation by unsupervised learning and to assign new hosts to these segments using supervised methods. Similarly, [5] utilizes Random Forests to assign newly observed hosts to departments respectively the central server infrastructure within an intranet.…”

“…The usage of standard NetFlow features to derive a network segmentation or characterize host behavior can be found in a number of works. Often the former are enriched by specially tailored features such as entropy measures [8], detection of connection spikes and bursts [9] or aggregated features for split time intervals [4]. In an IoT context, [10] extracts the MAC address of a device passively from ARP requests and searches a database for devices with a similar MAC address and known product type to determine the product type of this device.…”