NEMEA: A framework for network traffic analysis

Čejka, Tomáš; Bartoš, Václav; Švepeš, Marek; Zdenek, Rosa; Kubátová, Hana

doi:10.1109/cnsm.2016.7818417

Cited by 30 publications

(14 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For the evaluation, we use a NEMEA framework [2] which can be easily run in a single instance as well as in a distributed configuration. There are several detection modules in NEMEA and some of them were presented in our previous work.…”

Section: Discussionmentioning

confidence: 99%

Preserving Relations in Parallel Flow Data Processing

Čejka

Žádník

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Network monitoring produces high volume of data that must be analyzed ideally in near real-time to support network security operations. It is possible to process the data using Big Data frameworks, however, such approach requires adaptation or complete redesign of processing tools to get the same results. This paper elaborates on a parallel processing based on splitting a stream of flow records. The goal is to create subsets of traffic that contain enough information for parallel anomaly detection. The paper describes a methodology based on so called witnesses that helps to scale up without any need to modify existing algorithms.

show abstract

Section: Discussionmentioning

confidence: 99%

Preserving Relations in Parallel Flow Data Processing

Čejka

Žádník

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…where abc stands for the number of hidden neurons, a stands for the number of input neurons, b stands for the number of output neurons, c stands for empirical constant, and the data range is [1,10]. Due to relatively large network traffic [3], and the number of hidden layer is proportional to the neural network training speed, therefore the BP neural network classifier is not applicable to multiple hidden layer. Single hidden layer structure should be adopt, especially when the data traffic is relatively large.…”

Section: Structure Construction Of Bp Neural Network Classifiermentioning

confidence: 99%

Traffic Detection of Transmission of Botnet Threat Using Bp Neural Network

Li¹,

Wang²

2018

NNW

View full text Add to dashboard Cite

With the gradual improvement of the telecommunication infrastructure in China, the Internet and other new technologies have been frequently used. The Internet technology also brings many network security threats, for example, botnet, while bringing convenience. Botnet is a network formed between hosts controlled by malicious code. One of the most serious threat to network security faced by the Internet is a variety of malicious network attacks on the carrier of botnet. Back propagation (BP) neural network is proposed to detect botnet threat transmission. In this study, a botnet detection model was established using BP neural network system. BP neural network classifier could identify the botnet traffic and normal traffic. Moreover a test was carried out to detect botnet traffic using BP neural network; the performance of the BP neural network classifier was evaluated by the detection rate and false positive rate. The results showed that it had high detection rate and low false positive rate, which indicated that the BP neural network had a good performance in detecting the traffic of botnet threat transmission.

show abstract

“…For instance, TOPAS [1] and NEMEA [2] are flow-based systems that consists of modules that process data. When there is a big volume of flow data, running the systems on a single machine may reach resource limits of the machine.…”

Section: Related Workmentioning

confidence: 99%

Making Flow-Based Security Detection Parallel

Švepeš¹,

Čejka

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Flow based monitoring is currently a standard approach suitable for large networks of ISP size. The main advantage of flow processing is a smaller amount of data due to aggregation. There are many reasons (such as huge volume of transferred data, attacks represented by many flow records) to develop scalable systems that can process flow data in parallel. This paper deals with splitting a stream of flow data in order to perform parallel anomaly detection on distributed computational nodes. Flow data distribution is focused not only on uniformity but mainly on successful detection. The results of an experimental analysis show that the proposed approach does not break important semantic relations between individual flow records and therefore it preserves detection results. All experiments were performed using real data traces from Czech National Education and Research Network.

show abstract

NEMEA: A framework for network traffic analysis

Cited by 30 publications

References 7 publications

Preserving Relations in Parallel Flow Data Processing

Preserving Relations in Parallel Flow Data Processing

Traffic Detection of Transmission of Botnet Threat Using Bp Neural Network

Making Flow-Based Security Detection Parallel

Contact Info

Product

Resources

About