Publications

2019

Flow-based network traffic generation using Generative Adversarial Networks. Ring, Markus; Schlör, Daniel; Landes, Dieter; Hotho, Andreas in Computers & Security (2019). 82 156–172.
[ Abstract ] [ BibTeX ] [ URL ] [ DOI ] [ Download ]
 
Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.
@article{RING2019156, abstract = {Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.}, author = {Ring, Markus and Schlör, Daniel and Landes, Dieter and Hotho, Andreas}, journal = {Computers & Security}, keywords = {myown 2019 security:selected GAN network security flow from:hotho traffic generation}, pages = {156 - 172}, title = {Flow-based network traffic generation using Generative Adversarial Networks}, volume = 82, year = 2019 }

Comparison of System Call Representations for Intrusion Detection. Wunderlich, Sarah; Ring, Markus; Landes, Dieter; Hotho, Andreas (2019).
[ BibTeX ]
 
@article{wunderlich2019comparison, author = {Wunderlich, Sarah and Ring, Markus and Landes, Dieter and Hotho, Andreas}, keywords = {myown comparison intrusion system call detection representation from:nosebrain}, title = {Comparison of System Call Representations for Intrusion Detection}, year = 2019 }

A survey of network-based intrusion detection data sets. Ring, Markus; Wunderlich, Sarah; Scheuring, Deniz; Landes, Dieter; Hotho, Andreas in Comput. Secur. (2019). 86 147–167.
[ BibTeX ] [ URL ]
 
@article{ring2019survey, author = {Ring, Markus and Wunderlich, Sarah and Scheuring, Deniz and Landes, Dieter and Hotho, Andreas}, journal = {Comput. Secur.}, keywords = {myown intrusion network-based detection survey datasets}, pages = {147-167}, title = {A survey of network-based intrusion detection data sets}, volume = 86, year = 2019 }

2017

Flow-based benchmark data sets for intrusion detection. Ring, Markus; Wunderlich, Sarah; Grüdl, Dominik; Landes, Dieter; Hotho, Andreas (2017). 361–369.
[ BibTeX ] [ Download ]
 
@inproceedings{ring2017flow, author = {Ring, Markus and Wunderlich, Sarah and Gr{ü}dl, Dominik and Landes, Dieter and Hotho, Andreas}, booktitle = {Proceedings of the 16th European Conference on Cyber Warfare and Security}, keywords = {myown intrusion detection 2017 citedby:scholar:count:4 citedby:scholar:timestamp:2018-1-31 security flow from:hotho benchmark}, pages = {361–369}, title = {Flow-based benchmark data sets for intrusion detection}, year = 2017 }

Creation of Flow-Based Data Sets for Intrusion Detection. Ring, Markus; Wunderlich, Sarah; Grüdl, Dominik; Landes, Dieter; Hotho, Andreas in Journal of Information Warfare (2017). 16(4) 41–54.
[ Abstract ] [ BibTeX ] [ URL ] [ Download ]
 
Publicly available labelled data sets are necessary for evaluating anomaly-based Intrusion Detection Systems (IDS). However, existing data sets are often not up-to-date or not yet published because of privacy concerns. This paper identifies requirements for good data sets and proposes an approach for their generation. The key idea is to use a test environment and emulate realistic user behaviour with parameterised scripts on the clients. Comprehensive logging mechanisms provide additional information which may be used for a better understanding of the inner dynamics of an IDS. Finally, the proposed approach is used to generate the flow-based CIDDS-002 data set.
@article{ring2017creation, abstract = {Publicly available labelled data sets are necessary for evaluating anomaly-based Intrusion Detection Systems (IDS). However, existing data sets are often not up-to-date or not yet published because of privacy concerns. This paper identifies requirements for good data sets and proposes an approach for their generation. The key idea is to use a test environment and emulate realistic user behaviour with parameterised scripts on the clients. Comprehensive logging mechanisms provide additional information which may be used for a better understanding of the inner dynamics of an IDS. Finally, the proposed approach is used to generate the flow-based CIDDS-002 data set.}, author = {Ring, Markus and Wunderlich, Sarah and Grüdl, Dominik and Landes, Dieter and Hotho, Andreas}, journal = {Journal of Information Warfare}, keywords = {myown security:selected netflow from:markus0412 ids cidds openstack security}, month = {Dez}, number = 4, pages = {41-54}, title = {Creation of Flow-Based Data Sets for Intrusion Detection}, volume = 16, year = 2017 }

A Toolset for Intrusion and Insider Threat Detection. Ring, Markus; Wunderlich, Sarah; Grüdl, Dominik; Landes, Dieter; Hotho, Andreas in Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications, I. Palomares Carrascosa, H. K. Kalutarage, Y. Huang (Hrsg.) (2017). 3–31.
[ Abstract ] [ BibTeX ] [ URL ] [ DOI ] [ Download ]
 
Company data are a valuable asset and must be protected against unauthorized access and manipulation. In this contribution, we report on our ongoing work that aims to support IT security experts with identifying novel or obfuscated attacks in company networks, irrespective of their origin inside or outside the company network. A new toolset for anomaly based network intrusion detection is proposed. This toolset uses flow-based data which can be easily retrieved by central network components. We study the challenges of analysing flow-based data streams using data mining algorithms and build an appropriate approach step by step. In contrast to previous work, we collect flow-based data for each host over a certain time window, include the knowledge of domain experts and analyse the data from three different views. We argue that incorporating expert knowledge and previous flows allow us to create more meaningful attributes for subsequent analysis methods. This way, we try to detect novel attacks while simultaneously limiting the number of false positives.
@inbook{Ring2017, abstract = {Company data are a valuable asset and must be protected against unauthorized access and manipulation. In this contribution, we report on our ongoing work that aims to support IT security experts with identifying novel or obfuscated attacks in company networks, irrespective of their origin inside or outside the company network. A new toolset for anomaly based network intrusion detection is proposed. This toolset uses flow-based data which can be easily retrieved by central network components. We study the challenges of analysing flow-based data streams using data mining algorithms and build an appropriate approach step by step. In contrast to previous work, we collect flow-based data for each host over a certain time window, include the knowledge of domain experts and analyse the data from three different views. We argue that incorporating expert knowledge and previous flows allow us to create more meaningful attributes for subsequent analysis methods. This way, we try to detect novel attacks while simultaneously limiting the number of false positives.}, address = {Cham}, author = {Ring, Markus and Wunderlich, Sarah and Gr{ü}dl, Dominik and Landes, Dieter and Hotho, Andreas}, booktitle = {Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications}, editor = {Palomares Carrascosa, Iv{á}n and Kalutarage, Harsha Kumara and Huang, Yan}, keywords = {myown intrusion security:selected from:markus0412 security}, pages = {3–31}, publisher = {Springer International Publishing}, title = {A Toolset for Intrusion and Insider Threat Detection}, year = 2017 }