NetFlow anomaly detection though parallel cluster density analysis in continuous time-series

Kieran Flanagan; Enda Fallon; Paul Connolly; Abir Awad

doi:10.1007/978-3-319-61382-6_18

NetFlow anomaly detection though parallel cluster density analysis in continuous time-series

Kieran Flanagan^*, Enda Fallon, Paul Connolly, Abir Awad

^*Corresponding author for this work

Faculty of Computing, Engineering and Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

The increase in malicious network based attacks has resulted in a growing interest in network anomaly detection. The ability to detect unauthorized or malicious activity on a network is of importance to any organization. With the increase in novel attacks, anomaly detection techniques can be more successful in detecting unknown malicious activity in comparison to traditional signature based methods. However, in a real-world environment, there are many variables that cannot be simulated. This paper proposes an architecture where parallel clustering algorithms work concurrently in order to detect abnormalities that may be lost while traversing over time-series windows. The presented results describe the NetFlow activity of the NPD Group, Inc. over a 24-hour period. The presented results contain real-world anomalies that were detected.

Original language	English
Title of host publication	Wired/Wireless Internet Communications
Subtitle of host publication	15th IFIP WG 6.2 International Conference, WWIC 2017 St. Petersburg, Russia, June 21–23, 2017 Proceedings
Editors	Yevgeni Koucheryavy, Lefteris Mamatas, Ibrahim Matta, Aleksandr Ometov, Panagiotis Papadimitriou
Publisher	Springer
Pages	221-232
Number of pages	12
Volume	10372 LNCS
ISBN (Electronic)	978-3-319-61382-6
ISBN (Print)	978-3-319-61381-9
DOIs	https://doi.org/10.1007/978-3-319-61382-6_18
Publication status	Published - 15 Jun 2017
Event	15th International Conference on Wired/Wireless Internet Communications, WWIC 2017 - St. Petersburg, Russian Federation Duration: 21 Jun 2017 → 23 Jun 2017

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	10372 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	15th International Conference on Wired/Wireless Internet Communications, WWIC 2017
Country/Territory	Russian Federation
City	St. Petersburg
Period	21/06/17 → 23/06/17

Keywords

Anomaly detection
Clustering
Density analysis
NetFlow

Access to Document

10.1007/978-3-319-61382-6_18Licence: CC BY-NC-ND

Cite this

Flanagan, K., Fallon, E., Connolly, P., & Awad, A. (2017). NetFlow anomaly detection though parallel cluster density analysis in continuous time-series. In Y. Koucheryavy, L. Mamatas, I. Matta, A. Ometov, & P. Papadimitriou (Eds.), Wired/Wireless Internet Communications : 15th IFIP WG 6.2 International Conference, WWIC 2017 St. Petersburg, Russia, June 21–23, 2017 Proceedings (Vol. 10372 LNCS, pp. 221-232). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10372 LNCS). Springer. https://doi.org/10.1007/978-3-319-61382-6_18

Flanagan, Kieran ; Fallon, Enda ; Connolly, Paul et al. / NetFlow anomaly detection though parallel cluster density analysis in continuous time-series. Wired/Wireless Internet Communications : 15th IFIP WG 6.2 International Conference, WWIC 2017 St. Petersburg, Russia, June 21–23, 2017 Proceedings. editor / Yevgeni Koucheryavy ; Lefteris Mamatas ; Ibrahim Matta ; Aleksandr Ometov ; Panagiotis Papadimitriou. Vol. 10372 LNCS Springer, 2017. pp. 221-232 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{e9cc1f873b7b4125a83405503d99f3a2,

title = "NetFlow anomaly detection though parallel cluster density analysis in continuous time-series",

abstract = "The increase in malicious network based attacks has resulted in a growing interest in network anomaly detection. The ability to detect unauthorized or malicious activity on a network is of importance to any organization. With the increase in novel attacks, anomaly detection techniques can be more successful in detecting unknown malicious activity in comparison to traditional signature based methods. However, in a real-world environment, there are many variables that cannot be simulated. This paper proposes an architecture where parallel clustering algorithms work concurrently in order to detect abnormalities that may be lost while traversing over time-series windows. The presented results describe the NetFlow activity of the NPD Group, Inc. over a 24-hour period. The presented results contain real-world anomalies that were detected.",

keywords = "Anomaly detection, Clustering, Density analysis, NetFlow",

author = "Kieran Flanagan and Enda Fallon and Paul Connolly and Abir Awad",

note = "USW staff member left September 2017; 15th International Conference on Wired/Wireless Internet Communications, WWIC 2017 ; Conference date: 21-06-2017 Through 23-06-2017",

year = "2017",

month = jun,

day = "15",

doi = "10.1007/978-3-319-61382-6_18",

language = "English",

isbn = "978-3-319-61381-9",

volume = "10372 LNCS",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "221--232",

editor = "Koucheryavy, {Yevgeni } and Lefteris Mamatas and Ibrahim Matta and Ometov, {Aleksandr } and Papadimitriou, {Panagiotis }",

booktitle = "Wired/Wireless Internet Communications",

address = "Germany",

}

Flanagan, K, Fallon, E, Connolly, P & Awad, A 2017, NetFlow anomaly detection though parallel cluster density analysis in continuous time-series. in Y Koucheryavy, L Mamatas, I Matta, A Ometov & P Papadimitriou (eds), Wired/Wireless Internet Communications : 15th IFIP WG 6.2 International Conference, WWIC 2017 St. Petersburg, Russia, June 21–23, 2017 Proceedings. vol. 10372 LNCS, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 10372 LNCS, Springer, pp. 221-232, 15th International Conference on Wired/Wireless Internet Communications, WWIC 2017, St. Petersburg, Russian Federation, 21/06/17. https://doi.org/10.1007/978-3-319-61382-6_18

NetFlow anomaly detection though parallel cluster density analysis in continuous time-series. / Flanagan, Kieran; Fallon, Enda; Connolly, Paul et al.

Wired/Wireless Internet Communications : 15th IFIP WG 6.2 International Conference, WWIC 2017 St. Petersburg, Russia, June 21–23, 2017 Proceedings. ed. / Yevgeni Koucheryavy; Lefteris Mamatas; Ibrahim Matta; Aleksandr Ometov; Panagiotis Papadimitriou. Vol. 10372 LNCS Springer, 2017. p. 221-232 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10372 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - NetFlow anomaly detection though parallel cluster density analysis in continuous time-series

AU - Flanagan, Kieran

AU - Fallon, Enda

AU - Connolly, Paul

AU - Awad, Abir

N1 - USW staff member left September 2017

PY - 2017/6/15

Y1 - 2017/6/15

N2 - The increase in malicious network based attacks has resulted in a growing interest in network anomaly detection. The ability to detect unauthorized or malicious activity on a network is of importance to any organization. With the increase in novel attacks, anomaly detection techniques can be more successful in detecting unknown malicious activity in comparison to traditional signature based methods. However, in a real-world environment, there are many variables that cannot be simulated. This paper proposes an architecture where parallel clustering algorithms work concurrently in order to detect abnormalities that may be lost while traversing over time-series windows. The presented results describe the NetFlow activity of the NPD Group, Inc. over a 24-hour period. The presented results contain real-world anomalies that were detected.

AB - The increase in malicious network based attacks has resulted in a growing interest in network anomaly detection. The ability to detect unauthorized or malicious activity on a network is of importance to any organization. With the increase in novel attacks, anomaly detection techniques can be more successful in detecting unknown malicious activity in comparison to traditional signature based methods. However, in a real-world environment, there are many variables that cannot be simulated. This paper proposes an architecture where parallel clustering algorithms work concurrently in order to detect abnormalities that may be lost while traversing over time-series windows. The presented results describe the NetFlow activity of the NPD Group, Inc. over a 24-hour period. The presented results contain real-world anomalies that were detected.

KW - Anomaly detection

KW - Clustering

KW - Density analysis

KW - NetFlow

U2 - 10.1007/978-3-319-61382-6_18

DO - 10.1007/978-3-319-61382-6_18

M3 - Conference contribution

AN - SCOPUS:85021744350

SN - 978-3-319-61381-9

VL - 10372 LNCS

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 221

EP - 232

BT - Wired/Wireless Internet Communications

A2 - Koucheryavy, Yevgeni

A2 - Mamatas, Lefteris

A2 - Matta, Ibrahim

A2 - Ometov, Aleksandr

A2 - Papadimitriou, Panagiotis

PB - Springer

T2 - 15th International Conference on Wired/Wireless Internet Communications, WWIC 2017

Y2 - 21 June 2017 through 23 June 2017

ER -

Flanagan K, Fallon E, Connolly P, Awad A. NetFlow anomaly detection though parallel cluster density analysis in continuous time-series. In Koucheryavy Y, Mamatas L, Matta I, Ometov A, Papadimitriou P, editors, Wired/Wireless Internet Communications : 15th IFIP WG 6.2 International Conference, WWIC 2017 St. Petersburg, Russia, June 21–23, 2017 Proceedings. Vol. 10372 LNCS. Springer. 2017. p. 221-232. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-61382-6_18

NetFlow anomaly detection though parallel cluster density analysis in continuous time-series

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this