Computer Network Monitoring Research Articles

Training Guidance with KDD Cup 1999 and NSL-KDD Data Sets of ANIDINR: Anomaly-Based Network Intrusion Detection System

Abstract In today’s world, the protection of the computer networks remains one of the most crucial and difficult challenges in cyber security. In this work, a passive defence system ANIDINR is presented, aiming to monitor and protect computer networks. Our effort is focused on providing step-by-step guidance on methodologies selection and execution for the Machine and Deep Learning models’ training. Taking as an input two data sets, five MDL models are evaluated. Our goals are to minimise the percentage of Undetected Attack, the percentage of False Alarm Rate and the overall testing time. Based on this set-up, the proposed system is capable to predict in near-to-real time well-known and zero-day computer network attacks.

A Hybrid Nested Genetic-Fuzzy Algorithm Framework for Intrusion Detection and Attacks

Intrusion Detection System (IDS) plays a very important role in security systems. Among its different types, Network Intrusion Detection System (NIDS) has an effective role in monitoring computer networks systems for malicious and illegal activities. In the literature, the detection of DoS and Probe attacks were with reasonable accuracy in most of the NIDS researches. However, the detection accuracy of other categories of attacks is still low, such as the R2L and U2R in KDDCUP99 dataset along with the Backdoors and Worms in UNSW-NB15 dataset. Computational Intelligence (CI) techniques have the characteristics to address such imprecision problem. In this research, a Hybrid Nested Genetic-Fuzzy Algorithm (HNGFA) framework has been developed to produce highly optimized outputs for security experts in classifying both major and minor categories of attacks. The adaptive model is evolved using two-nested Genetic-Fuzzy Algorithms (GFA). Each GFA consists of two-nested Genetic Algorithms (GA). The outer is to evolve fuzzy sets and the inner is to evolve fuzzy rules. The outer GFA assists the inner GFA in training phase, where the best individual in outer GFA interacts with the weak individual in inner GFA to generate new solutions that enhance the prediction of mutated attacks. Both GFA interact together to evolve the best rules for normal, major and minor categories of attacks through the optimization process. Several experiments have been conducted with different settings over different datasets. The obtained results show that the developed model has good accuracy and is more efficient compared with several state-of-the-art techniques.

The Next Generation Cognitive Security Operations Center: Network Flow Forensics Using Cybersecurity Intelligence

A Security Operations Center (SOC) can be defined as an organized and highly skilled team that uses advanced computer forensics tools to prevent, detect and respond to cybersecurity incidents of an organization. The fundamental aspects of an effective SOC is related to the ability to examine and analyze the vast number of data flows and to correlate several other types of events from a cybersecurity perception. The supervision and categorization of network flow is an essential process not only for the scheduling, management, and regulation of the network’s services, but also for attacks identification and for the consequent forensics’ investigations. A serious potential disadvantage of the traditional software solutions used today for computer network monitoring, and specifically for the instances of effective categorization of the encrypted or obfuscated network flow, which enforces the rebuilding of messages packets in sophisticated underlying protocols, is the requirements of computational resources. In addition, an additional significant inability of these software packages is they create high false positive rates because they are deprived of accurate predicting mechanisms. For all the reasons above, in most cases, the traditional software fails completely to recognize unidentified vulnerabilities and zero-day exploitations. This paper proposes a novel intelligence driven Network Flow Forensics Framework (NF3) which uses low utilization of computing power and resources, for the Next Generation Cognitive Computing SOC (NGC2SOC) that rely solely on advanced fully automated intelligence methods. It is an effective and accurate Ensemble Machine Learning forensics tool to Network Traffic Analysis, Demystification of Malware Traffic and Encrypted Traffic Identification.

Sonification of network traffic flow for monitoring and situational awareness.

Maintaining situational awareness of what is happening within a computer network is challenging, not only because the behaviour happens within machines, but also because data traffic speeds and volumes are beyond human ability to process. Visualisation techniques are widely used to present information about network traffic dynamics. Although they provide operators with an overall view and specific information about particular traffic or attacks on the network, they often still fail to represent the events in an understandable way. Also, because they require visual attention they are not well suited to continuous monitoring scenarios in which network administrators must carry out other tasks. Here we present SoNSTAR (Sonification of Networks for SiTuational AwaReness), a real-time sonification system for monitoring computer networks to support network administrators’ situational awareness. SoNSTAR provides an auditory representation of all the TCP/IP traffic within a network based on the different traffic flows between between network hosts. A user study showed that SoNSTAR raises situational awareness levels by enabling operators to understand network behaviour and with the benefit of lower workload demands (as measured by the NASA TLX method) than visual techniques. SoNSTAR identifies network traffic features by inspecting the status flags of TCP/IP packet headers. Combinations of these features define particular traffic events which are mapped to recorded sounds to generate a soundscape that represents the real-time status of the network traffic environment. The sequence, timing, and loudness of the different sounds allow the network to be monitored and anomalous behaviour to be detected without the need to continuously watch a monitor screen.

RRDTool: A Round Robin Database for Network Monitoring

RRDtool is a circular database which stores time series data. RRDtool assumes time-variable data in intervals of certain length. An interval is named as a step and specified upon creation of an RRD file which cannot be changed afterward. Because data may not always come at just the right time, RRDtool will automatically interpolate any submitted data. This is done to fit its internal timestamps. If we compare linear databases with RRD then we can say that RRD is non-linear like a circular queue. Usually, in a Round-Robin Database (RRD), time-series data like network bandwidth, memory usage, CPU load are stored. The data is stored in a non-linear way so that system storage footprint remains constant over time. This actually avoids resource-expensive purge jobs which reduce complexity. MySQL does NOT provide any such kind of storage engine. RRDtool has also the ability to create and feed this database. RRDtool stores data; that makes it a back end tool. The RRDtool command set allows the creation of graphs that makes it a front end tool as well. Other databases just stores data and cannot create graphs. RRD combined with NET-SNMP can collect data and using scripts we can generate beautiful real-time graphs which can be used for monitoring computer networks.

False alarm reduction in signature‐based IDS: game theory approach

AbstractSignature‐based intrusion detection systems (IDSs) are employed to monitor computer networks for signs of network intrusions. However, they produce a large number of false positive alarms when operated with default settings without considering the underlying network environment. Inundation of false alarms is the Achilles heel of IDS technology, which could render the IDS ineffective in detecting network attacks. Several false alarm minimization approaches have been proposed in the literature. However, there are many drawbacks associated with these works, namely, modification of well‐established attack signatures; heavy dependence on the attack signatures' reference numbers, which might not always be available; and non‐consideration of the underlying network context information. In this paper, we propose an efficient game theory‐based false alarm minimization scheme for signature‐based IDS. The proposed scheme uses a game theory‐based correlation engine to correlate IDS alarms with network vulnerabilities to minimize the overall false positive alarm rate of the IDS. Experimental results and comparison analysis of the proposed false alarm minimization framework with other frameworks on the benchmark DARPA intrusion detection evaluation dataset and an in‐house IIT Guwahati Lab dataset show that the proposed scheme achieves the highest accuracy among all the frameworks under consideration without degrading the overall detection rate of the IDS. Copyright © 2016 John Wiley & Sons, Ltd.

A Hybrid Snort-Negative Selection Network Intrusion Detection Technique

Intrusion Detection Systems (NIDSs) are systems that monitor computer networks to detect, identify and prevent the malicious events, which attempt to compromise the integrity, confidentiality or availability of computer networks. The NIDS may be classified according to the detection technique into two types, the Signature-Based and Anomaly-Based NIDS. In order to increase the efficiency of the NIDS, a hybrid signature-anomaly NIDS based on both snort and negative selection algorithm is proposed. To evaluate the efficacy of the proposed system the 1999 DARPA data set is used. The experimental results show that the performance of the proposed system is more efficient than using snort on its own. General Terms

The Exploitation of Instant Messaging to Monitor Computer Networks Using XMPP: A Study Focuses on School Computer Labs

The Exploitation of Instant Messaging to Monitor Computer Networks Using XMPP: A Study Focuses on School Computer Labs

Wi-Fi Enabled Personal Computer Network Monitoring System Using Smart Phone with Enhanced Security Measures

Abstract In today's Scenario, Remote Monitoring is a fascinating research aspect of mobile computing technology. In this research paper, our prime focus is on the Personal computer remote monitoring system. Another challenging task is the security while sharing data in remotely monitoring PC or handheld devices over Wi-Fi, 3G, and Bluetooth. An application model is proposed for Secure Personal Computer Network Monitoring System. The proposed application model is efficiently able to communicate and monitor the working between handheld devices and the Personal Computer over Wi-Fi using handheld devices. Monitoring the current state of any machine in the network is possible by fetching the current state of machine on android phone. In the proposed application model mobile devices are able to watch the running processes of personal computer(s). In the proposed and implemented application model, whatever information the handheld device (android phone) requests pertaining to the network is passed on by the server .We executed and tested the designed monitoring system for set of operations such as play-stop-pause, Audio/ video recording, active sessions of web sites monitoring, grabbing files, create or edit word documents, edit and sharing of important excel files, making and sharing presentations, Logging Off and Shutting Down the Personal Computer. A secured interaction, under already existing, wireless security protocols is accomplished by implementing a security algorithm to prevent internal attack by addressing Hole 196 Vulnerability of WPA/WPA2. Implemented the symmetric encryption algorithm based on stream ciphers provides confidentiality of the message between the Android Phone and the server.

Usage of Netflow in Security and Monitoring of Computer Networks

Management of a network is a challenging task without accurate traffic statistics. Through this paper the security benefits of implementing a Netflow [1] based analysis system and then a novel open source application useful in Netflow analysis and management of flow records is proposed. Netflow data provides important information about network conversations and behavior. Netflow statistics are generated by Cisco and Juniper routers and switches, as well as server software Netflow probes. Netflow data provides enough information to serve the needs of several different applications such as billing, network planning and most importantly traffic engineering, which we specifically analyze to assess the state of the network. The flow records are UDP packets lacking payload data which still provides enough data to the network administrator to be a valuable analysis tool. Netflow profiling is a good moderation which strikes a balance between detail and summary and provides a real-time analysis of traffic flows, connection information and abnormal network behavior. Netflow data on the router is sampled at a variable rate which actually satisfies the conditions which have been set to monitor the incoming traffic, and then compared periodically to test if an incoming sequence is a DOS or a possible threat to the network by examining the packet sequences. Through this paper the performance of a network is gauged by using a parameter called unexpectedness [2], which is a method to gauge the amount of traffic flowing through a network.

Fast Algorithms for Optimal Link Selection in Large-Scale Network Monitoring

The robustness and integrity of IP networks require efficient tools for traffic monitoring and analysis, which scale well with traffic volume and network size. We address the problem of optimal large-scale monitoring of computer networks under resource constraints. Specifically, we consider the task of selecting the “best” subset of at most <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">K</i> links to monitor, so as to optimally predict the traffic load at the remaining ones. Our notion of optimality is quantified in terms of the statistical error of network traffic predictors. The optimal monitoring problem at hand is akin to certain combinatorial constraints, which render the algorithms seeking the exact solution impractical. We develop a number of fast algorithms that improve upon existing algorithms in terms of computational complexity and accuracy. Our algorithms exploit the geometry of principal component analysis, which also leads us to new types of theoretical bounds on the prediction error. Finally, these algorithms are amenable to randomization, where the best of several parallel independent instances often yields the exact optimal solution. Their performance is illustrated and evaluated on simulated and real-network traces.

Virtual Instrument Measurement System Architecture Design Based on Database Management

The purpose of virtual instrument measurement system architecture design based on database management is to expand stand-alone mode into the measurement mode of network. Through computer network, multiple virtual instrument measurement networks for data storage, communication and control the formation of network measurement applications are realized. This article discusses the formation of virtual instrument based on the database and computer network monitoring and control network programs, measures and achievement.

Application of models of data traffic for monitoring computer networks air traffic control system

Application of models of data traffic for monitoring computer networks air traffic control system

Periodicity-Based Anomalies in Self-Similar Network Traffic Flow Measurements

Network traffic flow measurement is fundamental in timely monitoring computer networks and in diagnosing potential anomalies. Previous measurement studies have shown that network traffic flows are often self-similar. The degree of self-similarity is described by the Hurst parameter H. In the literature, various methods have been used in estimating H, while their performances have not been evaluated for network traces that contain periodicity-based anomalies. In this paper, we investigate the performance of well-known estimators for traffic flow measurements with periodicity-based anomalies. We derive analytical expressions for widely used estimation methods in time, frequency, wavelet, and eigen domains and demonstrate through simulations that periodicity-based anomalies affect Hurst parameter estimation, causing unreliable H estimates. We show that our theoretical and experimental results are consistent with the observations of real network traffic flow measurements.

Neural visualization of network traffic data for intrusion detection

This study introduces and describes a novel intrusion detection system (IDS) called MOVCIDS (mobile visualization connectionist IDS). This system applies neural projection architectures to detect anomalous situations taking place in a computer network. By its advanced visualization facilities, the proposed IDS allows providing an overview of the network traffic as well as identifying anomalous situations tackled by computer networks, responding to the challenges presented by volume, dynamics and diversity of the traffic, including novel (0-day) attacks. MOVCIDS provides a novel point of view in the field of IDSs by enabling the most interesting projections (based on the fourth order statistics; the kurtosis index) of a massive traffic dataset to be extracted. These projections are then depicted through a functional and mobile visualization interface, providing visual information of the internal structure of the traffic data. The interface makes MOVCIDS accessible from any mobile device to give more accessibility to network administrators, enabling continuous visualization, monitoring and supervision of computer networks. Additionally, a novel testing technique has been developed to evaluate MOVCIDS and other IDSs employing numerical datasets. To show the performance and validate the proposed IDS, it has been tested in different real domains containing several attacks and anomalous situations. In addition, the importance of the temporal dimension on intrusion detection, and the ability of this IDS to process it, are emphasized in this work.

Investigation of graph edit distance cost functions for detection of network anomalies

Computer networks are becoming ubiquitous. Accurately monitoring and managing the behaviour of these complex and dynamic networks is a challenging task. It has become crucial to develop and employ good network monitoring techniques that assist in identifying and correcting abnormalities that affect network reliability, performance, security and future planning. There has been significant research in the detection of change and anomalous events in computer networks. A recent novel approach represents the logical communications of a periodically observed network as a time series of graphs and applies the graph matching technique, graph edit distance, to monitor and detect anomalous behaviour in the network. To date, only simple cost functions for graph edit operations have been used in application to computer network monitoring. This article investigates simple normalisation and non-linear techniques in the graph edit distance cost function, to improve detection of specific traffic related network anomalies in the computer network domain.

Network Security Basics

Writing a basic article on network security is something like writing a brief introduction to flying a commercial airliner. Much must be omitted, and an optimistic goal is to enable the reader to appreciate the skills required. The first question to address is what we mean by "network security." Several possible fields of endeavor come to mind within this broad topic, and each is worthy of a lengthy article. To begin, virtually all the security policy issues apply to network as well as general computer security considerations. In fact, viewed from this perspective, network security is a subset of computer security. The art and science of cryptography and its role in providing confidentiality, integrity, and authentication represents another distinct focus even though it's an integral feature of network security policy. The topic also includes design and configuration issues for both network-perimeter and computer system security. The practical networking aspects of security include computer intrusion detection, traffic analysis, and network monitoring. This article focuses on these aspects because they principally entail a networking perspective.

Hi-DRA: Intrusion Detection for Internet Security

Intrusion detection systems monitor computer networks looking for evidence of malicious actions. Networks are complex systems, and a comprehensive intrusion detection solution has to be able to manage event streams with different content,speed, level of abstraction, and accessibility. Therefore, it is necessary to distribute intrusion detection sensors across multiple protected networks, manage their configuration as the security posture of the networks changes, and process the results of their analysis so that a high-level picture of the security state of the network can be provided to the administrators. This paper presents Hi-DRA, a network surveillance, analysis, and response system for high-speed WANs. The system provides a framework for the modular development of intrusion detection sensors in heterogeneous, high-speed environments. In addition, the system provides an infrastructure that supports the dynamic configuration of the sensors and the collection and interpretation of their results. The system, as a whole,is able to provide fine-grained monitoring across WANs and, at the same time,is able to correlate the results of the analysis of the different sensors into a high-level expressive description of security violations.

SIMILARITY MEASURES FOR HIERARCHICAL REPRESENTATIONS OF GRAPHS WITH UNIQUE NODE LABELS

A hierarchical abstraction scheme based on node contraction and two related similarity measures for graphs with unique node labels are proposed in this paper. The contraction scheme reduces the number of nodes in a graph and leads to a speed-up in the computation of graph similarity. Theoretical properties of the new graph similarity measures are derived and experimentally verified. A potential application of the proposed graph abstraction scheme in the domain of computer network monitoring is discussed.

Interception of Communications

This paper takes a brief look at reasons for monitoring computer networks and some of the methods by which this may be performed. An argument is made against the overuse of intrusive methods of eavesdropping, and recommends that network monitoring tools should be designed in such a way that they provide answers to questions supplied by network operators without providing the facilities to record unnecessary information which may in many cases be confidential. Even when using a network monitoring system for policing use of a network, it is possible to design systems in such a way that they perform a traffic classification process without releasing details of the traffic being monitored.