A Scalable, Real-Time Packet Capturing Solution

The evolution of technology and the increasing connectivity between devices lead to an increased risk of cyberattacks. Good protection systems, such as Intrusion Detection System (IDS) and Intrusion Prevention System (IPS), are essential in trying to prevent, detect and counter most of the attacks. However, the increasing creativity and type of attacks raise the need for more resources and processing power for the protection systems which, in turn, requires horizontal scalability to keep up with the massive companies’ network infrastructure and with the complexity of attacks. Technologies like machine learning, show promising results and can be of added value in the detection and prevention of attacks in real-time. But good algorithms and tools are not enough. They require reliable and solid datasets to be able to effectively train the protection systems. The development of a good dataset requires horizontal-scalable, robust, modular and fault-tolerance systems, so that the analyses may be done also in real-time. This paper describes an architecture for horizontal-scaling capture architecture, able to collect packets from multiple sources and prepared for real-time analysis. It depends on multiple modular nodes with specific roles to support different algorithms and tools.