Network attack detection at flow level

TL;DR

This paper introduces a flow-based network attack detection method utilizing Cisco NetFlow, capable of identifying common attacks like DDoS and port scanning, and listing malicious IP addresses for intrusion response.

Contribution

The paper presents a novel flow-level detection approach that integrates with intrusion systems to identify and list attack sources, enhancing network security measures.

Findings

Effective detection of DDoS and port scanning attacks

Ability to identify and list malicious IP addresses

Applicable in intrusion detection and IP blocking systems

Abstract

In this paper, we propose a new method for detecting unauthorized network intrusions, based on a traffic flow model and Cisco NetFlow protocol application. The method developed allows us not only to detect the most common types of network attack (DDoS and port scanning), but also to make a list of trespassers' IP-addresses. Therefore, this method can be applied in intrusion detection systems, and in those systems which lock these IP-addresses.