Netflow-based malware detection and data visualisation system

Abstract

This paper presents a system for network traffic visualisation and anomalies detection by means of data mining and machine learning techniques. First, this work describes and analyses existing solutions in the field of network anomalies detection in order to identify adapted techniques in that area. Afterwards, the system architecture and the adapted tools and libraries are presented. Particularly, two different anomalies detection methods are proposed. The key experiments and analysis focus on performance evaluation of the proposed algorithms. In particular, different setups are considered in order to evaluate such aspects as detection effectiveness and computational complexity. The obtained results are promising and show that the proposed system can be considered as a useful tool for the network administrator.