Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data. (21st May 2019)

• Record Type: Journal Article
• Authors: Andreoni Lopez, Martin; Mattos, Diogo M. F.; Duarte, Otto Carlos M. B.; Pujolle, Guy
• Is Part Of: Concurrency and computation. Volume 31:Number 20(2019)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2019-05-21
• Subjects: big data -- network traffic classification -- stream processing -- threat detection -- virtual network function; Parallel processing (Electronic computers) -- Periodicals; Parallel computers -- Periodicals; 004.35
• DOI: 10.1002/cpe.5344
• Languages: English
• ISSNs: 1532-0626

Abstract

Summary: The late detection of security threats causes a significant increase in the risk of irreparable damages and restricts any defense attempt. In this paper, we propose a sCA lableTR AfficC lassifier andA nalyzer (CATRACA). CATRACA works as an efficient online Intrusion Detection and Prevention System implemented as a Virtualized Network Function. CATRACA is based on Apache Spark, a Big Data Streaming processing system, and it is deployed over the Open Platform for Network Functions Virtualization (OPNFV), providing an accurate real‐time threat‐detection service. The system presents a friendly graphical interface that provides real‐time visualization of the traffic and the attacks that occur in the network. Our prototype can differentiate normal traffic from denial of service (DoS) attacks and vulnerability probes over 95% accuracy under three different datasets. Moreover, CATRACA handles streaming data under concept drift detection with more than 85% of accuracy.