Towards real-time intrusion detection for NetFlow and IPFIX

R.J. Hofstede, Vaclav Bartos, Anna Sperotto, Aiko Pras

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    39 Citations (Scopus)
    277 Downloads (Pure)


    DDoS attacks bring serious economic and technical damage to networks and enterprises. Timely detection and mitigation are therefore of great importance. However, when flow monitoring systems are used for intrusion detection, as it is often the case in campus, enterprise and backbone networks, timely data analysis is constrained by the architecture of NetFlow and IPFIX. In their current architecture, the analysis is performed after certain timeouts, which generally delays the intrusion detection for several minutes. This paper presents a functional extension for both NetFlow and IPFIX flow exporters, to allow for timely intrusion detection and mitigation of large flooding attacks. The contribution of this paper is threefold. First, we integrate a lightweight intrusion detection module into a flow exporter, which moves detection closer to the traffic observation point. Second, our approach mitigates attacks in near real-time by instructing firewalls to filter malicious traffic. Third, we filter flow data of malicious traffic to prevent flow collectors from overload. We validate our approach by means of a prototype that has been deployed on a backbone link of the Czech national research and education network CESNET.
    Original languageUndefined
    Title of host publicationProceedings of the 9th International Conference on Network and Service Management, CNSM 2013
    Place of PublicationUSA
    Number of pages8
    ISBN (Print)978-3-901882-53-1
    Publication statusPublished - Oct 2013
    Event9th International Conference on Network and Services Management, CNSM 2013 - Zurich, Switzerland
    Duration: 14 Oct 201318 Oct 2013
    Conference number: 9

    Publication series

    PublisherIEEE Computer Society


    Conference9th International Conference on Network and Services Management, CNSM 2013
    Abbreviated titleCNSM


    • EWI-23850
    • Denial of service
    • Intrusion Detection
    • NetFlow
    • METIS-300097
    • IR-87853
    • Flow monitoring
    • IPFIX
    • Internet measurements

    Cite this