An Evaluation Design for Comparing Netflow Based Network Anomaly Detection Systems Using Synthetic Malicious Traffic
Shuvo Bardhan, Mitsuhiro Hatada, James Filliben, Douglas Montgomery, Alexander Jia
In this paper, we present an evaluation procedure for comparing multiple netflow based network anomaly detection (NF-NAD) systems based on accuracy of detection and mean time of detection. Conventionally, different variations of benign or normal traffic have been used to evaluate NF-NAD systems. Here we showcase a methodology where benign traffic is constant through the entirety of the experiment. We create different variations of synthetic malicious traffic (instead of benign traffic) to evaluate and compare NF-NAD systems. We achieve this through a two-phase approach, where Phase I and Phase II are conjointly used to measure the accuracy and learning capability of the NF-NAD system. We have created a designed experiment (having factors, levels and design points) to showcase our methodology. Keywords:
, Hatada, M.
, Filliben, J.
, Montgomery, D.
and Jia, A.
An Evaluation Design for Comparing Netflow Based Network Anomaly Detection Systems Using Synthetic Malicious Traffic, Technical Note (NIST TN), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.TN.2142, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=931392
(Accessed September 27, 2021)