Novel Bi-directional Flow-based Traffic Generation Framework for IDS Evaluation and Exploratory Data Analysis

Abstract

Flow-based network traffic information has been recently used to detect malicious intrusion. However, several available public flow-based datasets are unidirectional, and bidirectional flow-based datasets are rarely available. In this paper, a novel framework to generate bidirectional flow-based datasets for IDS evaluation is proposed. The generated dataset has the mixed combination of normal background traffic and attack traffic. The background traffic is based on the key traffic feature of the MAWI network traffic traces, and five popular attack traffics are generated based on their statistical traffic features. The generated dataset is characterized using the PCA approach, and we found out that benign and malicious traffic are distinct. With the proposed framework, a dataset of bi-directional flow-based traffic is generated and it would be used for evaluating an effective intrusion detection engine.

A Novel Framework for Generating Personalized Network Datasets for NIDS Based on Traffic Aggregation

“…Wilaux and Ngamsuriyaroj [21] proposed a framework to generate bidirectional flow data with 20 features based on the combination of background and malicious traffic. For background traffic, they use 15-min captures of real traffic from the MawiLab project [22].…”