Flow-Based Intrusion Detection

Anna Sperotto, Aiko Pras

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    33 Citations (Scopus)
    105 Downloads (Pure)


    The spread of 1-10 Gbps technology has in recent years paved the way to a flourishing landscape of new, high-bandwidth Internet services.At the same time, we have also observed increasingly frequent and widely diversified attacks. To this threat, the research community has answered with a growing interest in intrusion detection, aiming to timely detect intruders and prevent damage. We believe that the detection problem is a key component in the field of intrusion detection. Our studies, however, made us realize that additional research is needed, in particular focusing on validation and automatic tuning of Intrusion Detection Systems (IDSs). The contribution of this thesis is that it develops a structured approach to intrusion detection that focuses on (i) system validation and (ii) automatic system tuning. We developed our approach by focusing on network flows, which offer an aggregated view of network traffic and help to cope with scalability issues. An interesting approach to validation is the creation of appropriate testbeds, or ground-truth data sets, for which it is known when an attack has taken place. First, we obtained ground-truth information for flow-based intrusion detection by manually creating it. The outcome of our research is the first publicly released flow-based labeled data set. Second, we generated ground truth information in an automatic manner, by means of probabilistic traffic models based on Hidden Markov Models (HMMs). Finally, we approached the problem of automatic tuning of IDSs. The performance of an IDS is governed by the trade-off between detecting all anomalies (at the expense of raising alarms too often), and missing anomalies (but not issuing many false alarms). We developed an optimization procedure that aims to mathematically treat such trade-off in a systematic manner, by automatically tuning the system parameters.
    Original languageUndefined
    Title of host publicationProceedings of the IFIP/IEEE International Symposium on Integrated Network Management, IM 2011
    Place of PublicationUSA
    PublisherIEEE Communications Society
    Number of pages6
    ISBN (Print)978-1-4244-9219-0
    Publication statusPublished - May 2011
    Event12th IFIP/IEEE International Symposium on Integrated Network Management, IM 2011 - Trinity College Dublin, Dublin, Ireland
    Duration: 23 May 201127 May 2011
    Conference number: 12

    Publication series

    PublisherIEEE Communications Society


    Conference12th IFIP/IEEE International Symposium on Integrated Network Management, IM 2011
    Abbreviated titleIM 2011


    • METIS-279654
    • EWI-20320
    • EC Grant Agreement nr.: FP7/257513
    • IR-78449

    Cite this