Identifying network traffic features suitable for honeynet data analysis

Mohammed H. Sqalli, Syed Naeem Firdous, Khaled Salah, Marwan Abu-Amara

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

1 Scopus citations

Abstract

A honeynet is a solution designed by the Honeynet Project organization to gather information on security threats and it can be used to proactively improve network security. A honeynet captures a substantial amount of data and logs for analysis in order to identify malicious activities and this is a challenging task. The main aim of this work is to identify the best traffic features or parameters that can be used in an anomaly detection technique to identify anomalies in honeynet traffic. In this work, a detailed analysis of feature-based and volume-based parameters is carried out and the most appropriate features for honeynet traffic are selected. Unlike other techniques proposed in the literature, our work combines entropy distributions for feature-based parameters and volume distributions for volume-based parameters to evaluate the different features. The features were evaluated using real honeynet traces released by the Honeynet project organization and other sources.

Original languageBritish English
Title of host publication2011 Canadian Conference on Electrical and Computer Engineering, CCECE 2011
Pages1044-1048
Number of pages5
DOIs
StatePublished - 2011
Event2011 Canadian Conference on Electrical and Computer Engineering, CCECE 2011 - Niagara Falls, ON, Canada
Duration: 8 May 201111 May 2011

Publication series

NameCanadian Conference on Electrical and Computer Engineering
ISSN (Print)0840-7789

Conference

Conference2011 Canadian Conference on Electrical and Computer Engineering, CCECE 2011
Country/TerritoryCanada
CityNiagara Falls, ON
Period8/05/1111/05/11

Keywords

  • entropy
  • feature evaluation
  • Honeynet Traffic
  • network forensics
  • network security

Fingerprint

Dive into the research topics of 'Identifying network traffic features suitable for honeynet data analysis'. Together they form a unique fingerprint.

Cite this