Behavior-Aware Network Segmentation using IP Flows

D 2019

Behavior-Aware Network Segmentation using IP Flows

SMERIGA, Juraj a Tomáš JIRSÍK

Základní údaje

Originální název

Behavior-Aware Network Segmentation using IP Flows

Autoři

SMERIGA, Juraj a Tomáš JIRSÍK

Vydání

New York, NY, USA, Proceedings of the 14th International Conference on Availability, Reliability and Security, od s. 1-9, 9 s. 2019

Nakladatel

ACM

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14610/19:00110502

Organizační jednotka

Ústav výpočetní techniky

ISBN

978-1-4503-7164-3

Klíčová slova česky

IP flows; strojové učení; segmentace sítě; shluková analýza; behaviorální analýza

Klíčová slova anglicky

IP flows; machine learning; network segmentation; clustering; classification; behavior analysis

Štítky

core_B, rivok

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 16. 4. 2020 16:29, Mgr. Alena Mokrá

Anotace

V originále

Network segmentation is a powerful tool for network defense. In contemporary complex, dynamic, and multilayer networks, network segmentation suffers from lack of visibility into processes in the network, which results in less strict segment definition and loosen network security. Moreover, the dynamics of the networks makes the manual identification of network segments nearly impossible. In this paper, we inspect the possibilities of the behavior-aware network segmentation using IP flows and machine learning approaches that would enable to identify segments automatically, even in a complex network. We evaluate the suitability of clustering algorithms for identification of behavior-consistent segments in a network. We show that the clustering algorithms can identify relevant behavior-consistent clusters that overlap with those identified manually by experts. Apart from the segment identification, we investigate the other essential task of network segmentation process: assignment of an unknown host to an existing segment. We evaluate the performance of four different classification mechanisms on a real-world dataset. We show that it is possible to assign an unknown host to an appropriate network segment with up to 92% precision. Moreover, we release the whole dataset and experiment steps available for public use.

Návaznosti

EF16_019/0000822, projekt VaV

Název: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur

Přiložené soubory

2019-ARES-behavior-aware-network-segmentation-IP-flows.pdf Verze souboru

2019-ARES-behavior-aware-network-segmentation-IP-flows-presentation.pdf

Citovat

SMERIGA, Juraj a Tomáš JIRSÍK. Behavior-Aware Network Segmentation using IP Flows. Online. In Proceedings of the 14th International Conference on Availability, Reliability and Security. New York, NY, USA: ACM, 2019, s. 1-9. ISBN 978-1-4503-7164-3. Dostupné z: https://doi.org/10.1145/3339252.3339265.

@inproceedings{1550656,
   author = {Smeriga, Juraj and Jirsík, Tomáš},
   address = {New York, NY, USA},
   booktitle = {Proceedings of the 14th International Conference on Availability, Reliability and Security},
   doi = {https://doi.org/10.1145/3339252.3339265},
   keywords = {IP flows; machine learning; network segmentation; clustering; classification; behavior analysis},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {New York, NY, USA},
   isbn = {978-1-4503-7164-3},
   pages = {1-9},
   publisher = {ACM},
   title = {Behavior-Aware Network Segmentation using IP Flows},
   url = {http://doi.acm.org/10.1145/3339252.3339265},
   year = {2019}
}

TY  - CONF
ID  - 1550656
AU  - Smeriga, Juraj - Jirsík, Tomáš
PY  - 2019
TI  - Behavior-Aware Network Segmentation using IP Flows
PB  - ACM
CY  - New York, NY, USA
SN  - 9781450371643
KW  - IP flows
KW  - machine learning
KW  - network segmentation
KW  - clustering
KW  - classification
KW  - behavior analysis
UR  - http://doi.acm.org/10.1145/3339252.3339265
L2  - http://doi.acm.org/10.1145/3339252.3339265
N2  - Network segmentation is a powerful tool for network defense. In contemporary complex, dynamic, and multilayer networks, network segmentation suffers from lack of visibility into processes in the network, which results in less strict segment definition and loosen network security. Moreover, the dynamics of the networks makes the manual identification of network segments nearly impossible. In this paper, we inspect the possibilities of the behavior-aware network segmentation using IP flows and machine learning approaches that would enable to identify segments automatically, even in a complex network. We evaluate the suitability of clustering algorithms for identification of behavior-consistent segments in a network. We show that the clustering algorithms can identify relevant behavior-consistent clusters that overlap with those identified manually by experts. Apart from the segment identification, we investigate the other essential task of network segmentation process: assignment of an unknown host to an existing segment. We evaluate the performance of four different classification mechanisms on a real-world dataset. We show that it is possible to assign an unknown host to an appropriate network segment with up to 92% precision. Moreover, we release the whole dataset and experiment steps available for public use.
ER  -

SMERIGA, Juraj a Tomáš JIRSÍK. Behavior-Aware Network Segmentation using IP Flows. Online. In \textit{Proceedings of the 14th International Conference on Availability, Reliability and Security}. New York, NY, USA: ACM, 2019, s.~1-9. ISBN~978-1-4503-7164-3. Dostupné z: https://doi.org/10.1145/3339252.3339265.

Přehled o publikaci