Skip to main content

2017 | OriginalPaper | Buchkapitel

Analyzing and Detecting Network Intrusion Behavior Using Packet Capture

verfasst von : Zahidan Zabri, Puteri N. E. Nohuddin

Erschienen in: Advances in Visual Informatics

Verlag: Springer International Publishing

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

Network Intrusion is one of serious computer network security issues faced by almost all organizations or industries around the world. The big problem is that companies still have poor security to keep their network in good condition. Unfortunately, the management takes the simplest way by putting heavy responsibilities to network administrator rather than spending a high cost of computer security setup. In this paper describes a preliminary study for proposing a technique of analyzing network intrusion by using Packet Capture integrated with Network Intrusion Behavior Analysis Engine. This technique analyzes whether the flow of the network is healthy or malicious. The study consists of several components for implementing an effective and efficient network analyzing mechanism. Artificial Neural Network is selected as the main method for its behavior analysis engine. Then, it will illustrate the analysis result using an enhanced visualization method which gives more knowledge and understanding to the network administrators for effectively monitor network traffics.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
1.
Zurück zum Zitat Alfayyadh, B., Ponting, J., Alzomai, M., Jøsang, A.: Vulnerabilities in personal firewalls caused by poor security usability. In: 2010 IEEE International Conference on Information Theory and Information Security (ICITIS) (2010) Alfayyadh, B., Ponting, J., Alzomai, M., Jøsang, A.: Vulnerabilities in personal firewalls caused by poor security usability. In: 2010 IEEE International Conference on Information Theory and Information Security (ICITIS) (2010)
2.
Zurück zum Zitat Stavroulakis, P., Stamp, M.: Handbook of Information and Communication Security (2010) Stavroulakis, P., Stamp, M.: Handbook of Information and Communication Security (2010)
3.
Zurück zum Zitat Peng, X., Zhao, H.: A framework of attacker centric cyber attack behavior analysis. In: 2007 IEEE International Conference on Communications (2007) Peng, X., Zhao, H.: A framework of attacker centric cyber attack behavior analysis. In: 2007 IEEE International Conference on Communications (2007)
4.
Zurück zum Zitat Portnoy, L., Eskin, E., Stolfo, S.: Intrusion detection with unlabeled data using clustering. Department of Computer Science, Columbia University (2001) Portnoy, L., Eskin, E., Stolfo, S.: Intrusion detection with unlabeled data using clustering. Department of Computer Science, Columbia University (2001)
5.
Zurück zum Zitat Cecil, A.: A summary of network traffic monitoring and analysis techniques. Whitepaper (2006) Cecil, A.: A summary of network traffic monitoring and analysis techniques. Whitepaper (2006)
6.
Zurück zum Zitat Oluwabukola, O., Oludele, A., Ogbonna, A.C., Chigozirim, A., Amarachi, A.: A Packet Sniffer (PSniffer) Application for network security in Java. In: Cohen, E., Boyd, E. (eds.) Proceedings of Informing Science and Information Technology Education Conference 2013, pp. 389–400 (2013) Oluwabukola, O., Oludele, A., Ogbonna, A.C., Chigozirim, A., Amarachi, A.: A Packet Sniffer (PSniffer) Application for network security in Java. In: Cohen, E., Boyd, E. (eds.) Proceedings of Informing Science and Information Technology Education Conference 2013, pp. 389–400 (2013)
7.
Zurück zum Zitat Turk, Y., Demir, O., Gören, S.: Real time wireless packet monitoring with raspberry Pi sniffer. Inf. Sci. Syst. 2014, 185–192 (2014) Turk, Y., Demir, O., Gören, S.: Real time wireless packet monitoring with raspberry Pi sniffer. Inf. Sci. Syst. 2014, 185–192 (2014)
8.
Zurück zum Zitat Sondwale, P.P.: Overview of predictive and descriptive data mining techniques. Int. J. Advanced Research in Computer Science and Software Engineering, IJARCSSE, vol. 5 no. 4 (2015) Sondwale, P.P.: Overview of predictive and descriptive data mining techniques. Int. J. Advanced Research in Computer Science and Software Engineering, IJARCSSE, vol. 5 no. 4 (2015)
9.
Zurück zum Zitat Bloedorn, E., Christiansen, A.D., Hill, W., Skorupka, C., Talbot, L.M., Tivel, J.: Data mining for network intrusion detection: how to get started (2001) Bloedorn, E., Christiansen, A.D., Hill, W., Skorupka, C., Talbot, L.M., Tivel, J.: Data mining for network intrusion detection: how to get started (2001)
10.
Zurück zum Zitat Gupta, D., Singhai, S., Malik, S., Singh, A.: Network intrusion detection system using various data mining techniques. In: IEEE International Conference on Research Advances in Integrated Navigation Systems (RAINS) (2016) Gupta, D., Singhai, S., Malik, S., Singh, A.: Network intrusion detection system using various data mining techniques. In: IEEE International Conference on Research Advances in Integrated Navigation Systems (RAINS) (2016)
11.
Zurück zum Zitat Sindhu, S., Geetha, S., Kannan, A.: Decision tree based light weight intrusion detection using a wrapper approach. Expert Syst. Appl. 39, 129–141 (2012)CrossRef Sindhu, S., Geetha, S., Kannan, A.: Decision tree based light weight intrusion detection using a wrapper approach. Expert Syst. Appl. 39, 129–141 (2012)CrossRef
12.
Zurück zum Zitat Aggarwal, M., Amrita: Performance analysis of different feature selection methods in intrusion detection. Int. J. Sci. Technol. Res. 2(6), 225–231 (2013) Aggarwal, M., Amrita: Performance analysis of different feature selection methods in intrusion detection. Int. J. Sci. Technol. Res. 2(6), 225–231 (2013)
13.
Zurück zum Zitat Janecek, A.G.K., Gansterer, W.N., Demel, M.A., Ecker, G.F.: On the relationship between feature selection and classification accuracy. J. Mach. Learn. Res. 4, 90–105 (2008) Janecek, A.G.K., Gansterer, W.N., Demel, M.A., Ecker, G.F.: On the relationship between feature selection and classification accuracy. J. Mach. Learn. Res. 4, 90–105 (2008)
14.
Zurück zum Zitat Nohuddin, P.N.E., Christley, R., Coenen, F., Patel, Y., Setzkorn, C., Williams, S.: Frequent pattern trend analysis in social networks. In: Cao, L., Feng, Y., Zhong, J. (eds.) ADMA 2010. LNCS, vol. 6440, pp. 358–369. Springer, Heidelberg (2010). doi:10.1007/978-3-642-17316-5_35 CrossRef Nohuddin, P.N.E., Christley, R., Coenen, F., Patel, Y., Setzkorn, C., Williams, S.: Frequent pattern trend analysis in social networks. In: Cao, L., Feng, Y., Zhong, J. (eds.) ADMA 2010. LNCS, vol. 6440, pp. 358–369. Springer, Heidelberg (2010). doi:10.​1007/​978-3-642-17316-5_​35 CrossRef
15.
Zurück zum Zitat Münz, G., Carle, G.: Traffic anomaly detection using kmeans clustering. In: GI/ITG Workshop MMBnet (2016) Münz, G., Carle, G.: Traffic anomaly detection using kmeans clustering. In: GI/ITG Workshop MMBnet (2016)
16.
Zurück zum Zitat Phutane, T., Pathan, A.: A survey of intrusion detection system using different data mining techniques. Int. J. Innov. Res. Comput. Commun. Eng. 2, 11 (2014) Phutane, T., Pathan, A.: A survey of intrusion detection system using different data mining techniques. Int. J. Innov. Res. Comput. Commun. Eng. 2, 11 (2014)
17.
Zurück zum Zitat Bo, L., Dong-Dong, J.: The research of intrusion detection model based on clustering analysis. In: 2009 International Conference on Computer and Communications Security (2009) Bo, L., Dong-Dong, J.: The research of intrusion detection model based on clustering analysis. In: 2009 International Conference on Computer and Communications Security (2009)
18.
Zurück zum Zitat Kaur, H., Sing, G., Minhas, J.: A review of machine learning based anomaly detection techniques. Int. J. Comput. Appl. Technol. Res. 2(2), 185–187 (2013) Kaur, H., Sing, G., Minhas, J.: A review of machine learning based anomaly detection techniques. Int. J. Comput. Appl. Technol. Res. 2(2), 185–187 (2013)
19.
Zurück zum Zitat Srinivasulu, P., Nagaraju, D., Kumar, P.R., Rao, K.N.: Classifying the network intrusion attacks using data mining classification methods and their performance comparison. IJCSNS Int. J. Comput. Sci. Netw. Secur. 9, 6 (2009) Srinivasulu, P., Nagaraju, D., Kumar, P.R., Rao, K.N.: Classifying the network intrusion attacks using data mining classification methods and their performance comparison. IJCSNS Int. J. Comput. Sci. Netw. Secur. 9, 6 (2009)
20.
Zurück zum Zitat Pervez, S., Ahmad, I., Akram, A., Swati, S.U.: Comparative analysis of artificial neural network technologies in intrusion detection systems. In: Proceedings of 6th WSEAS International Conference on Multimedia, Internet & Video Technologies (2006) Pervez, S., Ahmad, I., Akram, A., Swati, S.U.: Comparative analysis of artificial neural network technologies in intrusion detection systems. In: Proceedings of 6th WSEAS International Conference on Multimedia, Internet & Video Technologies (2006)
21.
Zurück zum Zitat Moore, A.W., Zuev, D.: Internet traffic classification using bayesian analysis techniques. In: Proceedings of 2005 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems - SIGMETRICS 2005 (2005) Moore, A.W., Zuev, D.: Internet traffic classification using bayesian analysis techniques. In: Proceedings of 2005 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems - SIGMETRICS 2005 (2005)
22.
Zurück zum Zitat Gupta, A., Kumar, M., Rangra, A., Tiwari, V.K., Saxena, P.: Network intrusion detection types and analysis of their tools. Int. J. Eng. Res. Dev. 2, 1 (2013) Gupta, A., Kumar, M., Rangra, A., Tiwari, V.K., Saxena, P.: Network intrusion detection types and analysis of their tools. Int. J. Eng. Res. Dev. 2, 1 (2013)
23.
Zurück zum Zitat Youssef, A., Emam, A.: Network intrusion detection using data mining and network behaviour analysis. Int. J. Comput. Sci. Inf. Technol. 3(6), 87–98 (2011) Youssef, A., Emam, A.: Network intrusion detection using data mining and network behaviour analysis. Int. J. Comput. Sci. Inf. Technol. 3(6), 87–98 (2011)
24.
Zurück zum Zitat Northcutt, S., Novak, J.: Network Intrusion Detection, 3rd edn. Sams, Indianapolis (2002) Northcutt, S., Novak, J.: Network Intrusion Detection, 3rd edn. Sams, Indianapolis (2002)
25.
Zurück zum Zitat Reelsen, A.: Using Elasticsearch, Logstash and Kibana to Create Realtime Dashboards. Elasticsearch (2014) Reelsen, A.: Using Elasticsearch, Logstash and Kibana to Create Realtime Dashboards. Elasticsearch (2014)
26.
Zurück zum Zitat Hargrave, V.: Packet Capture with Pyshark and Elasticsearch (2015) Hargrave, V.: Packet Capture with Pyshark and Elasticsearch (2015)
27.
Zurück zum Zitat Gormley, C., Tong, Z.: Elasticsearch: The Definitive Guide. O’Reilly Media, Inc., Sebastopol (2017) Gormley, C., Tong, Z.: Elasticsearch: The Definitive Guide. O’Reilly Media, Inc., Sebastopol (2017)
Metadaten
Titel
Analyzing and Detecting Network Intrusion Behavior Using Packet Capture
verfasst von
Zahidan Zabri
Puteri N. E. Nohuddin
Copyright-Jahr
2017
DOI
https://doi.org/10.1007/978-3-319-70010-6_69