FIELDS : Flow Intrusion Extrusion Largescale Detection System
Résumé
This paper presents an advanced pre-processing, called FIELDS, for analyzing the network traffic based on flow assessments. FIELDS is an extensible Network Security Monitoring that supports 1) advanced traffic pre-processing, 2) forensics and 3) existing Network Extrusion/Intrusion Detection Systems. FIELDS has been experimented during two months using a large real network thanks to its non intrusive nature. The results show the efficiency of different heuristics for pre-processing the traffic relevant of an intrusion. FIELDS provides an unified and efficient tool for pre-processing the network traffic and detecting/controlling the potential internal/external intruders. FIELDS solves the problem of scalability for the monitoring of the security of large networks. It can be easily extended to integrate other heuristics and correlate the different analysis.