Publications

Environmental Science - Publications

← Back to research description.

2019[ to top ]

Flow-based network traffic generation using Generative Adversarial Networks Ring, Markus; Schlör, Daniel; Landes, Dieter; Hotho, Andreas in Computers & Security (2019). 82 156–172.
- [ Abstract ]
- [ BibTeX ]
- [ URL ]
- [ DOI ]
- [ Download ]
Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.

@article{RING2019156, abstract = {Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.}, author = {Ring, Markus and Schlör, Daniel and Landes, Dieter and Hotho, Andreas}, journal = {Computers & Security}, keywords = {generation}, pages = {156 - 172}, title = {Flow-based network traffic generation using Generative Adversarial Networks}, volume = 82, year = 2019 }
Comparison of System Call Representations for Intrusion Detection Wunderlich, Sarah; Ring, Markus; Landes, Dieter; Hotho, Andreas (2019).
- [ BibTeX ]
@article{wunderlich2019comparison, author = {Wunderlich, Sarah and Ring, Markus and Landes, Dieter and Hotho, Andreas}, keywords = {from:nosebrain}, title = {Comparison of System Call Representations for Intrusion Detection}, year = 2019 }
A survey of network-based intrusion detection data sets Ring, Markus; Wunderlich, Sarah; Scheuring, Deniz; Landes, Dieter; Hotho, Andreas in Comput. Secur. (2019). 86 147–167.
- [ BibTeX ]
- [ URL ]
@article{ring2019survey, author = {Ring, Markus and Wunderlich, Sarah and Scheuring, Deniz and Landes, Dieter and Hotho, Andreas}, journal = {Comput. Secur.}, keywords = {datasets}, pages = {147-167}, title = {A survey of network-based intrusion detection data sets}, volume = 86, year = 2019 }

2017[ to top ]

Flow-based benchmark data sets for intrusion detection Ring, Markus; Wunderlich, Sarah; Gr{\"u}dl, Dominik; Landes, Dieter; Hotho, Andreas in Proceedings of the 16th European Conference on Cyber Warfare and Security (2017). 361–369.
- [ BibTeX ]
- [ Download ]
@inproceedings{ring2017flow, author = {Ring, Markus and Wunderlich, Sarah and Gr{\"u}dl, Dominik and Landes, Dieter and Hotho, Andreas}, booktitle = {Proceedings of the 16th European Conference on Cyber Warfare and Security}, keywords = {benchmark}, pages = {361–369}, title = {Flow-based benchmark data sets for intrusion detection}, year = 2017 }
Creation of Flow-Based Data Sets for Intrusion Detection Ring, Markus; Wunderlich, Sarah; Grüdl, Dominik; Landes, Dieter; Hotho, Andreas in Journal of Information Warfare (2017). 16(4) 41–54.
- [ Abstract ]
- [ BibTeX ]
- [ URL ]
- [ Download ]
Publicly available labelled data sets are necessary for evaluating anomaly-based Intrusion Detection Systems (IDS). However, existing data sets are often not up-to-date or not yet published because of privacy concerns. This paper identifies requirements for good data sets and proposes an approach for their generation. The key idea is to use a test environment and emulate realistic user behaviour with parameterised scripts on the clients. Comprehensive logging mechanisms provide additional information which may be used for a better understanding of the inner dynamics of an IDS. Finally, the proposed approach is used to generate the flow-based CIDDS-002 data set.

@article{ring2017creation, abstract = {Publicly available labelled data sets are necessary for evaluating anomaly-based Intrusion Detection Systems (IDS). However, existing data sets are often not up-to-date or not yet published because of privacy concerns. This paper identifies requirements for good data sets and proposes an approach for their generation. The key idea is to use a test environment and emulate realistic user behaviour with parameterised scripts on the clients. Comprehensive logging mechanisms provide additional information which may be used for a better understanding of the inner dynamics of an IDS. Finally, the proposed approach is used to generate the flow-based CIDDS-002 data set.}, author = {Ring, Markus and Wunderlich, Sarah and Grüdl, Dominik and Landes, Dieter and Hotho, Andreas}, journal = {Journal of Information Warfare}, keywords = {security}, month = {Dez}, number = 4, pages = {41-54}, title = {Creation of Flow-Based Data Sets for Intrusion Detection}, volume = 16, year = 2017 }
A Toolset for Intrusion and Insider Threat Detection Ring, Markus; Wunderlich, Sarah; Gr{\"u}dl, Dominik; Landes, Dieter; Hotho, Andreas in Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications, I. Palomares Carrascosa, H. K. Kalutarage, Y. Huang (Hrsg.) (2017). 3–31.
- [ Abstract ]
- [ BibTeX ]
- [ URL ]
- [ DOI ]
- [ Download ]
Company data are a valuable asset and must be protected against unauthorized access and manipulation. In this contribution, we report on our ongoing work that aims to support IT security experts with identifying novel or obfuscated attacks in company networks, irrespective of their origin inside or outside the company network. A new toolset for anomaly based network intrusion detection is proposed. This toolset uses flow-based data which can be easily retrieved by central network components. We study the challenges of analysing flow-based data streams using data mining algorithms and build an appropriate approach step by step. In contrast to previous work, we collect flow-based data for each host over a certain time window, include the knowledge of domain experts and analyse the data from three different views. We argue that incorporating expert knowledge and previous flows allow us to create more meaningful attributes for subsequent analysis methods. This way, we try to detect novel attacks while simultaneously limiting the number of false positives.

@inbook{Ring2017, abstract = {Company data are a valuable asset and must be protected against unauthorized access and manipulation. In this contribution, we report on our ongoing work that aims to support IT security experts with identifying novel or obfuscated attacks in company networks, irrespective of their origin inside or outside the company network. A new toolset for anomaly based network intrusion detection is proposed. This toolset uses flow-based data which can be easily retrieved by central network components. We study the challenges of analysing flow-based data streams using data mining algorithms and build an appropriate approach step by step. In contrast to previous work, we collect flow-based data for each host over a certain time window, include the knowledge of domain experts and analyse the data from three different views. We argue that incorporating expert knowledge and previous flows allow us to create more meaningful attributes for subsequent analysis methods. This way, we try to detect novel attacks while simultaneously limiting the number of false positives.}, address = {Cham}, author = {Ring, Markus and Wunderlich, Sarah and Gr{\"u}dl, Dominik and Landes, Dieter and Hotho, Andreas}, booktitle = {Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications}, editor = {Palomares Carrascosa, Iv{\'a}n and Kalutarage, Harsha Kumara and Huang, Yan}, keywords = {security}, pages = {3–31}, publisher = {Springer International Publishing}, title = {A Toolset for Intrusion and Insider Threat Detection}, year = 2017 }

Hubland Süd, Geb. M2

Publications

Environmental Science - Publications

Data privacy protection

Data privacy protection

Picture credits