Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data - Archive ouverte HAL Access content directly
Journal Articles Concurrency and Computation: Practice and Experience Year : 2019

Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data

Abstract

The late detection of security threats causes a significant increase in the risk of irreparable damages and restricts any defense attempt. In this paper, we propose a sCAlable TRAffic Classifier and Analyzer (CATRACA). CATRACA works as an efficient online Intrusion Detection and Prevention System implemented as a Virtualized Network Function. CATRACA is based on Apache Spark, a Big Data Streaming processing system, and it is deployed over the Open Platform for Network Functions Virtualization (OPNFV), providing an accurate real‐time threat‐detection service. The system presents a friendly graphical interface that provides real‐time visualization of the traffic and the attacks that occur in the network. Our prototype can differentiate normal traffic from denial of service (DoS) attacks and vulnerability probes over 95% accuracy under three different datasets. Moreover, CATRACA handles streaming data under concept drift detection with more than 85% of accuracy.
Fichier principal
Vignette du fichier
Lopez et al. - Toward a monitoring and threat detection system ba.pdf (1.23 Mo) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-02188745 , version 1 (18-07-2019)

Identifiers

Cite

Martin Andreoni Lopez, Diogo Mattos, Otto Carlos M. B. Duarte, Guy Pujolle. Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data. Concurrency and Computation: Practice and Experience, In press, ⟨10.1002/cpe.5344⟩. ⟨hal-02188745⟩
112 View
476 Download

Altmetric

Share

Gmail Facebook Twitter LinkedIn More