Why are My Flows Different? A Tutorial on Flow Exporters

Vormayr, Gernot; Fabini, Joachim; Zseby, Tanja

doi:10.1109/comst.2020.2989695

Cited by 25 publications

(7 citation statements)

References 46 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In addition, as this approach uses aggregations, it is not as privacy-sensitive as deep packet inspection, which is particularly sought for from the perspective of various privacy-related laws and legislations, such as the GDPR [40]. Some of the available formats providing these benefits, along with flow capture tools and exporters are described in [52].…”

Section: Methods 31 Flow-based Datamentioning

confidence: 99%

Towards Deployment Shift Inhibition Through Transfer Learning in Network Intrusion Detection

Pawlicki

Kozik

Choraś

2022

Proceedings of the 17th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Currently, machine learning sees growing adoption in numerous domains, including critical applications, like cybersecurity. However, to fully enjoy the benefits of artificial intelligence the end-user has some high barriers to entry to circumnavigate. The deployment of machine-learning-based Network Intrusion Detection Systems requires the collection of labelled data to train the intelligent components. This is an expensive and laborious process, which necessitates expert knowledge in cyberattacks and computer networks. Even when using data collected and labelled on premises, phenomena like concept drift can cause the model to underperform -a concept known as deployment shift. This paper evaluates the use of transfer learning techniques to curb the effects of deployment shift in machine-learning-based network intrusion detection.

show abstract

Section: Methods 31 Flow-based Datamentioning

confidence: 99%

Towards Deployment Shift Inhibition Through Transfer Learning in Network Intrusion Detection

Pawlicki

Kozik

Choraś

2022

Proceedings of the 17th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

show abstract

“…3) where srcIP (srcPort) and dstIP (dstPort) are the source and destination IP addresses (network ports) of the two involved hosts, t is the timestamp of the first connection, d is the duration of the communication session, proto is the network protocol of the communication. Depending on the NetFlow software and its configuration, additional metrics can be computed: the most typical fields include the number of packets and bytes exchanged during the communication [57].…”

Section: A Overviewmentioning

confidence: 99%

“…The definition of F is software dependent[57], and outside our scope 8. www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/…”

mentioning

confidence: 99%

The Cross-Evaluation of Machine Learning-Based Network Intrusion Detection Systems

Pajola

Conti

2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Enhancing Network Intrusion Detection Systems (NIDS) with supervised Machine Learning (ML) is tough. ML-NIDS must be trained and evaluated, operations requiring data where benign and malicious samples are clearly labelled. Such labels demand costly expert knowledge, resulting in a lack of real deployments, as well as on papers always relying on the same outdated data. The situation improved recently, as some efforts disclosed their labelled datasets. However, most past works used such datasets just as a 'yet another' testbed, overlooking the added potential provided by such availability.In contrast, we promote using such existing labelled data to cross-evaluate ML-NIDS. Such approach received only limited attention and, due to its complexity, requires a dedicated treatment. We hence propose the first cross-evaluation model. Our model highlights the broader range of realistic use-cases that can be assessed via cross-evaluations, allowing the discovery of still unknown qualities of state-of-the-art ML-NIDS. For instance, their detection surface can be extended-at no additional labelling cost. However, conducting such cross-evaluations is challenging. Hence, we propose the first framework, XeNIDS, for reliable cross-evaluations based on Network Flows. By using XeNIDS on six well-known datasets, we demonstrate the concealed potential, but also the risks, of cross-evaluations of ML-NIDS.

show abstract

“…The packet capture was processed by the Flowmon flow exporter to obtain primary flow data containing information from TLS and HTTP protocols (1). Additional statistical features were extracted using GoFlows [83] flow exporter (2). The primary flows were filtered (3) to remove incomplete records and network scans before merging the data from both exporters (4).…”

Section: Dataset Creationmentioning

confidence: 99%

Passive Operating System Fingerprinting Revisited: Evaluation and Current Challenges

et al. 2022

View full text Add to dashboard Cite

Why are My Flows Different? A Tutorial on Flow Exporters

Cited by 25 publications

References 46 publications

Towards Deployment Shift Inhibition Through Transfer Learning in Network Intrusion Detection

Towards Deployment Shift Inhibition Through Transfer Learning in Network Intrusion Detection

The Cross-Evaluation of Machine Learning-Based Network Intrusion Detection Systems

Passive Operating System Fingerprinting Revisited: Evaluation and Current Challenges

Contact Info

Product

Resources

About