Print Email Facebook Twitter Efficient Learning of Communication Profiles from IP Flow Records Title Efficient Learning of Communication Profiles from IP Flow Records Author Hammerschmidt, C.A. (University of Luxembourg) Marchal, Samuel (Aalto University) State, Radu (University of Luxembourg) Pellegrino, G. (TU Delft Cyber Security) Verwer, S.E. (TU Delft Cyber Security) Contributor Kellenberger, Patrick (editor) Date 2016 Abstract The task of network traffic monitoring has evolved drastically with the ever-increasing amount of data flowing in large scale networks. The automated analysis of this tremendous source of information often comes with using simpler models on aggregated data (e.g. IP flow records) due to time and space constraints. A step towards utilizing IP flow records more effectively are stream learning techniques. We propose a method to collect a limited yet relevant amount of data in order to learn a class of complex models, finite state machines, in real-time. These machines are used as communication profiles to fingerprint, identify or classify hosts and services and offer high detection rates while requiring less training data and thus being faster to compute than simple models. Subject machine learningip flow analysisnetflowcommunication profilingbotnet detectionintrusion detection To reference this document use: http://resolver.tudelft.nl/uuid:f7985edc-61e0-4ec0-b0c4-66bf4f56fb4a DOI https://doi.org/10.1109/LCN.2016.92 Publisher IEEE, Los Alamitos, CA ISBN 978-1-5090-2054-6 Source Proceedings - 2016 IEEE 41st Conference on Local Computer Networks, LCN 2016 Event 2016 IEEE 41st Conference on Local Computer Networks, LCN 2016, 2016-11-07 → 2016-11-10, Dubai, United Arab Emirates Bibliographical note Accepted author manuscript Part of collection Institutional Repository Document type conference paper Rights © 2016 C.A. Hammerschmidt, Samuel Marchal, Radu State, G. Pellegrino, S.E. Verwer Files PDF Efficient_Learning_of_Com ... ecords.pdf 510.67 KB Close viewer /islandora/object/uuid:f7985edc-61e0-4ec0-b0c4-66bf4f56fb4a/datastream/OBJ/view