Utilizing Netflow Data to Detect Slow Read Attacks

摘要: Attackers can leverage several techniques to compromise computer networks, ranging from sophisticated malware DDoS (Distributed Denial of Service) attacks that target the application layer. Application layer attacks, such as Slow Read, are implemented with just enough traffic tie up CPU or memory resources causing web and servers go offline. Such mimic legitimate network requests making them difficult detect. They also utilize less volume than traditional attacks. These low attack methods often undetected by security solutions until it is too late. In this paper, we explore use machine learners for detecting Read on at Our approach uses a generated dataset based upon Netflow data collected live environment. IP Flow Information Export (IPFIX) standard providing significant flexibility features. features process handle growing amount have worked well in our previous work evasion techniques. consists real-world production network. We eight different classifiers build detection models. wide selection provides us more comprehensive analysis Experimental results show were quite successful identifying high false alarm rate. The experiment demonstrates chosen discriminative detect accurately