IT infrastructures around the world are targeted by malicious entities that want to steal data or compromise services. Protection measures for complex computer networks are expensive to deploy and maintain, and often do not offer protection against zero-day exploits. In-depth analysis of incoming and outgoing traffic can be problematic from legal and technical perspectives. The current work explores the possibility of implementing reliable security measures using machine learning algorithms to perform traffic classification. The new framework is mapped on existing parallel hardware and aims to provide a versatile solution for the detection of anomalous behaviour in network traffic through k-means clustering and without performing deep packet inspection. Trace analysis metadata is obtained by exploiting the features available in the pcapng file format. K-means clustering is implemented using multiple parallel APIs and a comparative analysis is presented together with performance considerations.
K-Means clustering, Shallow packet inspection, Parallelization, Tracing.
Radu VELEA, Casian CIOBANU, Laurențiu MĂRGĂRIT, Ion BICA, "Network Traffic Anomaly Detection Using Shallow Packet Inspection and Parallel K-means Data Clustering", Studies in Informatics and Control, ISSN 1220-1766, vol. 26(4), pp. 387-396, 2017. https://doi.org/10.24846/v26i4y201702
All articles published by Studies in Informatics and Control (SIC) are published in accordance with the terms and conditions of the Creative Commons Attribution License (CC BY-NC-SA 4.0).