Analysis of Anomalies in the Internet Traffic Observed at the Campus Network Gateway
Veronica del Carmen Estrada

TL;DR
This paper investigates anomalies in real network traffic from a large academic environment, highlighting data quality issues and their impact on intrusion detection system performance and research validity.
Contribution
It provides a detailed analysis of anomalies in operational network data, revealing challenges in data quality and configuration that affect intrusion detection accuracy.
Findings
Identified various anomalies in 12 hours of real network traffic
Documented data capture and configuration problems affecting analysis
Highlighted the importance of data quality in intrusion detection research
Abstract
A considerable portion of the machine learning literature applied to intrusion detection uses outdated data sets based on a simulated network with a limited environment. Moreover, flaws usually appear in datasets and the way we handle them may impact on measurements. Finally, the detection capacity of intrusion detection is highly influenced by the system configuration. We focus on a topic rarely investigated: the characterization of anomalies in a large network environment. Intrusion Detection System (IDS) are used to detect exploits or other attacks that raise alarms. These anomalous events usually receive less attention than attack alarms, causing them to be frequently overlooked by security administrators. However, the observation of this activity contributes to understand the traffic network characteristics. On one hand, abnormal behaviors may be legitimate, e.g., misinterpreted…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Advanced Malware Detection Techniques
