TY - GEN
T1 - Real-time analysis of flow data for network attack detection
AU - Münz, Gerhard
AU - Carle, Georg
PY - 2007
Y1 - 2007
N2 - With the wide deployment of flow monitoring in IP networks, the analysis of the exported flow data has become an important research area. It has been shown that flow data can be used to detect traffic anomalies, DoS attacks, and the propagation of worms. In practice, anomalies and attacks should be detected as fast as possible in order to allow taking appropriate countermeasures. We describe the necessary steps from the raw flow data to the detection result in a systematic way. Furthermore, we present TOPAS, a system and framework for real-time analysis of flow data, that has been developed in order to meet these requirements. Performance measurements and various application examples point out the capabilities and benefits of our approach.
AB - With the wide deployment of flow monitoring in IP networks, the analysis of the exported flow data has become an important research area. It has been shown that flow data can be used to detect traffic anomalies, DoS attacks, and the propagation of worms. In practice, anomalies and attacks should be detected as fast as possible in order to allow taking appropriate countermeasures. We describe the necessary steps from the raw flow data to the detection result in a systematic way. Furthermore, we present TOPAS, a system and framework for real-time analysis of flow data, that has been developed in order to meet these requirements. Performance measurements and various application examples point out the capabilities and benefits of our approach.
KW - Anomaly and attack detection
KW - Flow analysis
KW - Network monitoring
UR - http://www.scopus.com/inward/record.url?scp=34748852070&partnerID=8YFLogxK
U2 - 10.1109/INM.2007.374774
DO - 10.1109/INM.2007.374774
M3 - Conference contribution
AN - SCOPUS:34748852070
SN - 1424407990
SN - 9781424407996
T3 - 10th IFIP/IEEE International Symposium on Integrated Network Management 2007, IM '07
SP - 100
EP - 108
BT - 10th IFIP/IEEE International Symposium on Integrated Network Management 2007, IM '07
T2 - 10th IFIP/IEEE International Symposium on Integrated Network Management 2007, IM '07
Y2 - 21 May 2007 through 25 May 2007
ER -