An Evaluation Design for Comparing Netflow Based Network Anomaly Detection Systems Using Synthetic Malicious Traffic

Published

March 2, 2021

Author(s)

Shuvo Bardhan, Mitsuhiro Hatada, James Filliben, Douglas Montgomery, Alexander Jia

Abstract

In this paper, we present an evaluation procedure for comparing multiple netflow based network anomaly detection (NF-NAD) systems based on accuracy of detection and mean time of detection. Conventionally, different variations of benign or normal traffic have been used to evaluate NF-NAD systems. Here we showcase a methodology where benign traffic is constant through the entirety of the experiment. We create different variations of synthetic malicious traffic (instead of benign traffic) to evaluate and compare NF-NAD systems. We achieve this through a two-phase approach, where Phase I and Phase II are conjointly used to measure the accuracy and learning capability of the NF-NAD system. We have created a designed experiment (having factors, levels and design points) to showcase our methodology. Keywords:

Citation

Technical Note (NIST TN) - 2142

Report Number

2142

NIST Pub Series

Technical Note (NIST TN)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.TN.2142

Local Download

Keywords

Network Anomaly Detection Systems, Experiment Design, Netflows, Computer Worms

Citation

Bardhan, S. , Hatada, M. , Filliben, J. , Montgomery, D. and Jia, A. (2021), An Evaluation Design for Comparing Netflow Based Network Anomaly Detection Systems Using Synthetic Malicious Traffic, Technical Note (NIST TN), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.TN.2142, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=931392 (Accessed October 13, 2025)