Flow-based intrusion detection: Techniques and challenges. Issue 70 (September 2017)

• Record Type: Journal Article
• Authors: Umer, Muhammad Fahad; Sher, Muhammad; Bi, Yaxin
• Is Part Of: Computers & security. Issue 70(2017)
• Page Start: 238
• Page End: 254
• Publication Date: 2017-09
• Subjects: Network flows -- Flow-based intrusion detection -- Flow-based datasets -- Attack detection -- Machine learning; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.05.009
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Flow-based intrusion detection is an innovative way of detecting intrusions in high-speed networks. Flow-based intrusion detection only inspects the packet header and does not analyze the packet payload. This paper provides a comprehensive survey of current state of the art in flow-based intrusion detection. It also describes the available flow-based datasets used for evaluation of flow-based intrusion detection systems. The paper proposes a taxonomy for flow-based intrusion detection systems on the basis of the technique used for detection of maliciousness in flow records. We review the architecture and evaluation results of available flow-based intrusion detection systems. We also identify important research challenges for future research in the area of flow-based intrusion detection.