A Software Deep Packet Inspection System for Network Traffic Analysis and Anomaly Detection
Artykuł w czasopiśmie
MNiSW
100
Lista 2021
| Status: | |
| Autorzy: | Song Wenguang, Beshley Mykola, Przystupa Krzysztof, Beshley Halyna, Kochan Orest, Pryslupskyi Andrii, Pieniak Daniel, Su Jun |
| Dyscypliny: | |
| Aby zobaczyć szczegóły należy się zalogować. | |
| Rok wydania: | 2020 |
| Wersja dokumentu: | Drukowana | Elektroniczna |
| Język: | angielski |
| Numer czasopisma: | 6 |
| Wolumen/Tom: | 20 |
| Numer artykułu: | 1637 |
| Strony: | 1 - 41 |
| Web of Science® Times Cited: | 28 |
| Scopus® Cytowania: | 44 |
| Bazy: | Web of Science | Scopus |
| Efekt badań statutowych | NIE |
| Finansowanie: | This research was supported by the project No 0120U100674 “Development of the novel decentralized mobile network based on blockchain-architecture and artificial intelligence for 5G/6G development in Ukraine”. This work was supported by PetroChina Innovation Foundation (2017D-5007-0304) and Hubei Science and Technology Demonstration Project, Oilfield Data Intelligent Analysis and Research Center (2019ZYYD016). This work was supported by Lublin University of Technology (contract no. FN-31/E/EE/2019). The research was financed from the university-wide grant of the University of Economics and Innovation in Lublin (WSEI) entitled "Three-axis machine for the simulation of occlusive biomechanical loads”. |
| Materiał konferencyjny: | NIE |
| Publikacja OA: | TAK |
| Licencja: | |
| Sposób udostępnienia: | Witryna wydawcy |
| Wersja tekstu: | Ostateczna wersja opublikowana |
| Czas opublikowania: | W momencie opublikowania |
| Data opublikowania w OA: | 14 marca 2020 |
| Abstrakty: | angielski |
| In this paper, to solve the problem of detecting network anomalies, a method of forming a set of informative features formalizing the normal and anomalous behavior of the system on the basis of evaluating the Hurst (H) parameter of the network tra_c has been proposed. Criteria to detect and prevent various types of network anomalies using the Three Sigma Rule and Hurst parameter have been defined. A rescaled range (RS) method to evaluate the Hurst parameter has been chosen. The practical value of the proposed method is conditioned by a set of the following factors: low time spent on calculations, short time required for monitoring, the possibility of self-training, as well as the possibility of observing a wide range of tra_c types. For new DPI (Deep Packet Inspection) system implementation, algorithms for analyzing and captured tra_c with protocol detection and determining statistical load parameters have been developed. In addition, algorithms that are responsible for flow regulation to ensure the QoS (Quality of Services) based on the conducted static analysis of flows and the proposed method of detection of anomalies using the parameter Hurst have been developed. We compared the proposed software DPI system with the existing SolarWinds Deep Packet Inspection for the possibility of network tra_c anomaly detection and prevention. The created software components of the proposed DPI system increase the e_ciency of using standard intrusion detection and prevention systems by identifying and taking into account new non-standard factors and dependencies. The use of the developed system in the IoT communication infrastructure will increase the level of information security and significantly reduce the risks of its loss |
