NetFlow Anomaly Detection Dataset Creation for Traffic Analysis

Evita Roponena; Inese Polaka; Janis Grabis

doi:10.1109/ITMS64072.2024.10741602

NetFlow Anomaly Detection Dataset Creation for Traffic Analysis

Evita Roponena^*
, Inese Polaka
, Janis Grabis

^*Corresponding author for this work

Riga Technical University

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › Research › peer-review

2 Citations (Scopus)

Abstract

Information and communication technologies (ICT) and their security are essential for large enterprises and higher education institutions to maintain business integrity. These technologies create a large amount of data that should be analysed simultaneously to detect threats in the ICT system to protect the data. NetFlow is a network protocol that can be used to monitor network traffic, collect IP addresses, and detect anomalies in NetFlow. This study provides a method for creating a dataset of real-life NetFlow for anomaly detection using machine learning. The dataset was validated by implementing anomaly detection with the K-means clustering algorithm and time-series forecasting using the long short-term memory method. The study provides a feature dataset for both machine learning methods and an overview of the anomaly detection methods used in this research.

Original language	English
Title of host publication	2024 IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Proceedings
Editors	Janis Grabis, Andrejs Romanovs, Marta Narigina
Publisher	Institute of Electrical and Electronics Engineers Inc.
Edition	2024
ISBN (Electronic)	9798331533830
DOIs	https://doi.org/10.1109/ITMS64072.2024.10741602
Publication status	Published - 2024
Externally published	Yes
Event	65th IEEE International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Riga, Latvia Duration: 3 Oct 2024 → 4 Oct 2024

Conference

Conference	65th IEEE International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024
Country/Territory	Latvia
City	Riga
Period	3/10/24 → 4/10/24

Keywords

anomaly detection
clustering
feature engineering
machine learning
netflow
time-series

Access to Document

10.1109/ITMS64072.2024.10741602

Cite this

Roponena, E., Polaka, I., & Grabis, J. (2024). NetFlow Anomaly Detection Dataset Creation for Traffic Analysis. In J. Grabis, A. Romanovs, & M. Narigina (Eds.), 2024 IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Proceedings (2024 ed.). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ITMS64072.2024.10741602

Roponena, Evita ; Polaka, Inese ; Grabis, Janis. / NetFlow Anomaly Detection Dataset Creation for Traffic Analysis. 2024 IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Proceedings. editor / Janis Grabis ; Andrejs Romanovs ; Marta Narigina. 2024. ed. Institute of Electrical and Electronics Engineers Inc., 2024.

@inproceedings{94399194594c4646b89412c9a98fafcb,

title = "NetFlow Anomaly Detection Dataset Creation for Traffic Analysis",

abstract = "Information and communication technologies (ICT) and their security are essential for large enterprises and higher education institutions to maintain business integrity. These technologies create a large amount of data that should be analysed simultaneously to detect threats in the ICT system to protect the data. NetFlow is a network protocol that can be used to monitor network traffic, collect IP addresses, and detect anomalies in NetFlow. This study provides a method for creating a dataset of real-life NetFlow for anomaly detection using machine learning. The dataset was validated by implementing anomaly detection with the K-means clustering algorithm and time-series forecasting using the long short-term memory method. The study provides a feature dataset for both machine learning methods and an overview of the anomaly detection methods used in this research.",

keywords = "anomaly detection, clustering, feature engineering, machine learning, netflow, time-series",

author = "Evita Roponena and Inese Polaka and Janis Grabis",

note = "Publisher Copyright: {\textcopyright} 2024 IEEE.; 65th IEEE International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 ; Conference date: 03-10-2024 Through 04-10-2024",

year = "2024",

doi = "10.1109/ITMS64072.2024.10741602",

language = "English",

editor = "Janis Grabis and Andrejs Romanovs and Marta Narigina",

booktitle = "2024 IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Proceedings",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

address = "United States",

edition = "2024",

}

Roponena, E, Polaka, I & Grabis, J 2024, NetFlow Anomaly Detection Dataset Creation for Traffic Analysis. in J Grabis, A Romanovs & M Narigina (eds), 2024 IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Proceedings. 2024 edn, Institute of Electrical and Electronics Engineers Inc., 65th IEEE International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024, Riga, Latvia, 3/10/24. https://doi.org/10.1109/ITMS64072.2024.10741602

NetFlow Anomaly Detection Dataset Creation for Traffic Analysis. / Roponena, Evita; Polaka, Inese; Grabis, Janis.
2024 IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Proceedings. ed. / Janis Grabis; Andrejs Romanovs; Marta Narigina. 2024. ed. Institute of Electrical and Electronics Engineers Inc., 2024.

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › Research › peer-review

TY - GEN

T1 - NetFlow Anomaly Detection Dataset Creation for Traffic Analysis

AU - Roponena, Evita

AU - Polaka, Inese

AU - Grabis, Janis

PY - 2024

Y1 - 2024

N2 - Information and communication technologies (ICT) and their security are essential for large enterprises and higher education institutions to maintain business integrity. These technologies create a large amount of data that should be analysed simultaneously to detect threats in the ICT system to protect the data. NetFlow is a network protocol that can be used to monitor network traffic, collect IP addresses, and detect anomalies in NetFlow. This study provides a method for creating a dataset of real-life NetFlow for anomaly detection using machine learning. The dataset was validated by implementing anomaly detection with the K-means clustering algorithm and time-series forecasting using the long short-term memory method. The study provides a feature dataset for both machine learning methods and an overview of the anomaly detection methods used in this research.

AB - Information and communication technologies (ICT) and their security are essential for large enterprises and higher education institutions to maintain business integrity. These technologies create a large amount of data that should be analysed simultaneously to detect threats in the ICT system to protect the data. NetFlow is a network protocol that can be used to monitor network traffic, collect IP addresses, and detect anomalies in NetFlow. This study provides a method for creating a dataset of real-life NetFlow for anomaly detection using machine learning. The dataset was validated by implementing anomaly detection with the K-means clustering algorithm and time-series forecasting using the long short-term memory method. The study provides a feature dataset for both machine learning methods and an overview of the anomaly detection methods used in this research.

KW - anomaly detection

KW - clustering

KW - feature engineering

KW - machine learning

KW - netflow

KW - time-series

UR - https://www.scopus.com/pages/publications/85214424146

U2 - 10.1109/ITMS64072.2024.10741602

DO - 10.1109/ITMS64072.2024.10741602

M3 - Conference paper

AN - SCOPUS:85214424146

BT - 2024 IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Proceedings

A2 - Grabis, Janis

A2 - Romanovs, Andrejs

A2 - Narigina, Marta

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 65th IEEE International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024

Y2 - 3 October 2024 through 4 October 2024

ER -

Roponena E, Polaka I, Grabis J. NetFlow Anomaly Detection Dataset Creation for Traffic Analysis. In Grabis J, Romanovs A, Narigina M, editors, 2024 IEEE 65th International Scientific Conference on Information Technology and Management Science of Riga Technical University, ITMS 2024 - Proceedings. 2024 ed. Institute of Electrical and Electronics Engineers Inc. 2024 doi: 10.1109/ITMS64072.2024.10741602

NetFlow Anomaly Detection Dataset Creation for Traffic Analysis

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this