Behavior-Aware Network Segmentation using IP Flows.
2019
Network segmentation is a powerful tool for network defense. In
contemporary complex, dynamic, and multilayer networks, network
segmentation suffers from lack of visibility into processes in
the network, which results in less strict segment definition
and loosen network security. Moreover, the dynamics of the
networks makes the manual identification of network segments
nearly impossible. In this paper, we inspect the possibilities
of the behavior-aware network segmentation using IP flows and
machine learning approaches that would enable to identify
segments automatically, even in a complex network. We evaluate
the suitability of clustering algorithms for identification of
behavior-consistent segments in a network. We show that the
clustering algorithms can identify relevant behavior-consistent
clusters that overlap with those identified manually by
experts. Apart from the segment identification, we investigate
the other essential task of network segmentation process:
assignment of an unknown host to an existing segment. We
evaluate the performance of four different classification
mechanisms on a real-world dataset. We show that it is possible
to assign an unknown host to an appropriate network segment
with up to 92% precision. Moreover, we release the whole
dataset and experiment steps available for public use.
Keywords:
- Correction
- Source
- Cite
- Save
- Machine Reading By IdeaReader
26
References
0
Citations
NaN
KQI