Challenges in Identifying Network Attacks Using Netflow Data

Chuah, Edward and Suri, Neeraj and Jhumka, Arshad and Alt, Samantha (2022) Challenges in Identifying Network Attacks Using Netflow Data. In: 2021 IEEE 20th International Symposium on Network Computing and Applications (NCA) :. IEEE. ISBN 9781665495516

[thumbnail of nca2021]
Text (nca2021)
nca2021.pdf - Accepted Version
Available under License Creative Commons Attribution-NonCommercial.

Download (708kB)

Abstract

Large networks often encounter attacks that can affect the network availability. While multiple techniques exist to detect network attacks, a comprehensive understanding of how an attack occurs considering the various layers and components of the network software stack, can be an important element to help improve network security. By performing correlation analysis on contemporary unlabeled Netflow data, this paper conducts a comprehensive study of network flow events to identify communication patterns that may precede an attack, thereby providing potentially useful attack signatures to network administrators. Our work shows that, surprisingly, the Netflow data is not strongly correlated to network attacks. We observe that while spoof requests trigger reflection attacks, only a small percentage of the network packets are associated with the attack. Furthermore, lead time enhancements are feasible for reflection attacks that show long dwell times. Our study on network event correlations highlights empirical observations that could facilitate better attack handling in large networks.

Item Type:
Contribution in Book/Report/Proceedings
Additional Information:
©2021 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
ID Code:
165368
Deposited By:
Deposited On:
31 Jan 2022 16:15
Refereed?:
Yes
Published?:
Published
Last Modified:
12 Feb 2024 00:56