Real-Time and resilient intrusion detection: a flow-based approach

Authors:
Rick Hofstede;Aiko Pras
Affiliations:
Design and Analysis of Communication Systems (DACS), University of Twente, Enschede, The Netherlands;Design and Analysis of Communication Systems (DACS), University of Twente, Enschede, The Netherlands
Venue:
AIMS'12 Proceedings of the 6th IFIP WG 6.6 international autonomous infrastructure, management, and security conference on Dependable Networks and Services
Year:
2012

Citing 2
Cited 1

Properties and prediction of flow statistics from sampled packet streams

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
An Overview of IP Flow-Based Intrusion Detection

IEEE Communications Surveys & Tutorials

Towards learning normality for anomaly detection in industrial control networks

AIMS'13 Proceedings of the 7th IFIP WG 6.6 international conference on Autonomous Infrastructure, Management, and Security: emerging management mechanisms for the future internet - Volume 7943

Quantified Score

Hi-index	0.00

Visualization

Abstract

Flow-based intrusion detection will play an important role in high-speed networks, due to the stringent performance requirements of packet-based solutions. Flow monitoring technologies, such as NetFlow or IPFIX, aggregate individual packets into flows, requiring new intrusion detection algorithms to deal with the aggregated data. These algorithms are subject to constraints on real-time and accurate detection of intrusions, due to the nature of current flow monitoring technologies. In this paper, we propose a framework for flow-based intrusion detection, aiming to detect intrusions in real-time, and to be resilient against negative effects of attacks on monitoring systems. This research is still in its initial phase and will contribute to a Ph.D. thesis after four years.