11institutetext: Delft University of Technology, Mekelweg 5 2628 CD Delft, The
Netherlands
11email<EMAIL_ADDRESS>
22institutetext: Thales SIX GTS France, 4 Avenue des Louvresses Gennevilliers,
92622 France
22email<EMAIL_ADDRESS>
# Encoding NetFlows for State-Machine Learning

Clinton Cao 11 Annibale Panichella 11 Sicco Verwer 11 Agathe Blaise 22 Filippo
Rebecchi 22

###### Abstract

NetFlow data is a well-known network log format used by many network analysts
and researchers. The advantages of using this format compared to pcap are that
it contains fewer data, is less privacy intrusive, and is easier to collect
and process. However, having less data does mean that this format might not be
able to capture important network behaviour as all information is summarised
into statistics. Much research aims to overcome this disadvantage through the
use of machine learning, for instance, to detect attacks within a network.
Many approaches can be used to pre-process the NetFlow data before it is used
to train the machine learning algorithms. However, many of these approaches
simply apply existing methods to the data, not considering the specific
properties of network data. We argue that for data originating from software
systems, such as NetFlow or software logs, similarities in frequency and
contexts of feature values are more important than similarities in the value
itself. In this work, we, therefore, propose an encoding algorithm that
directly takes the frequency and the context of the feature values into
account when the data is being processed. Different types of network
behaviours can be clustered using this encoding, thus aiding the process of
detecting anomalies within the network. From windows of these clusters
obtained from monitoring a clean system, we learn state machine behavioural
models for anomaly detection. These models are very well-suited to modelling
the cyclic and repetitive patterns present in NetFlow data. We evaluate our
encoding on a new dataset that we created for detecting problems in Kubernetes
clusters and on two well-known public NetFlow datasets. The obtained
performance results of the state machine models are comparable to existing
works that use many more features and require both clean and infected data as
training input.

###### Keywords:

NetFlow Runtime Analysis State Machine Machine Learning Anomaly Detection.

##  1 Introduction

NetFlow is a well-known format, introduced by Cisco [10] in 1996, that a
network administrator can use to analyze the traffic that is occurring in the
network. Each flow contains network statistics of a connection between two
hosts. These statistics can be used to compute performance statistics and to
infer whether any strange behaviours are occurring within the network. The use
of NetFlow over deep packet inspection for network analysis comes with several
advantages; NetFlow contains less data, is less privacy intrusive as it is not
possible to inspect every single packet and it is easier to collect and
process. However, since NetFlow contains less data, it also makes it harder to
infer malicious network behaviour as we might be losing essential information
looking only at the statistics of a communication between two hosts.

Several NetFlows datasets are available online that contain both benign and
malicious flows [11, 14, 18, 19]. The datasets can be used to train and
evaluate machine-learning algorithms for intrusion and attack detection.
Before a machine learning algorithm is applied to a dataset, the usual
practice is to investigate and pre-process the dataset. This process helps
remove any properties that could influence the final model learned from the
data. Additionally, this process can help find the most important features for
learning accurate models. There are several techniques that can be applied
during the pre-processing steps; normalisation of the numerical features [13,
26, 28], feature selection [23, 25, 30], encoding numerical features [9, 15,
22] and extracting aggregated features from existing dataset [6, 12, 20, 21].

Thus, there exists a plethora of preprocessing techniques that can be applied
to NetFlow datasets. Most of these treat the NetFlow data like a traditional
data source and encode the number of transferred bytes and flow duration as
standard numerical features. We argue that this is incorrect as data generated
by software is not standard. For instance, there exists no noise in the number
of bytes and similarly sized flows can have very different meaning. We
therefore propose a new encoding inspired by Word2Vec [17] that treats every
unique feature value as a different word. The similarities between these words
is determined by their context and frequency. We consider frequency especially
important for NetFlow data, as we commonly observe flows with a specific
number of bytes occur very often. Although we cannot know the meaning of these
flows since we do not know the flow content, we can infer that their meaning
is different from flow values that occur much less frequently, even when they
differ by only a single byte. We consider similarly frequent flows to be
similar only when they occur in similar contexts. As context, we use the
feature values of the flows before and after along the same connection.

We create a new encoding algorithm to encode NetFlow data. The result is a
matrix that can be used to compute distances between flow feature values based
on context and frequency. We cluster these values into groups of similarly
behaving values. For each network connection, we then build sliding windows of
these groups and provide these to a state-machine learning algorithm [27] to
learn a behavioural model for flow sequences. In contrast to many existing
works that process NetFlow using machine learning [6, 7, 9, 12, 13, 15, 21,
24, 29, 30], this algorithm requires only benign data as input (unsupervised)
and can thus be used to detect unseen attacks. State-machines are key models
for the design of software systems. They have frequently been used to model
the kinds of sequential patterns present in software data including network
traffic [22].

To evaluate our algorithm, we used it to pre-process NetFlow data from three
different datasets. We apply our encoding to only the duration and the number
of bytes. We include the protocol as a discrete feature and all other features
including the used ports are ignored. Although ports can be useful for
detecting network intrusions, they frequently contain spurious patterns due to
the data collection setup. Our experiments include a new dataset we created
for detecting anomalies in a Kubernetes cluster. Across all datasets, our
encoding and machine learning setup show good performance, sometimes
outperforming supervised approaches that use more features.

###  1.1 Our Contribution

Our contributions in this work are summed up as follows:

  * •

We provide a new encoding algorithm that can be used to pre-process NetFlow
data. The algorithm extracts context and frequency information from NetFlow
data and uses these to build clusters of flow types.

  * •

We show an application of our encoding algorithm by learning state machine
models from the encoded NetFlow data in an unsupervised manner and using it
for anomaly detection.

  * •

We provide a new NetFlow dataset that researchers can use to evaluate anomaly
detection methods.

  * •

We show that using only three features, our approach can achieve a $F_{1}$
score between 0.82 and 0.99, outperforming some of the existing works.

###  1.2 Threat Model

In this work, we have considered a particular threat model for our anomaly
detection approach using state machine models. We briefly describe the goals
and the capabilities of the adversary.

####  1.2.1 Goals of the Adversary

We have considered an adversary that has the following goals: the adversary
wants to infiltrate a targeted network and infects machines in the network
with malware, or the adversary wants to take down a network by launching
different types of attacks against the targeted network.

####  1.2.2 Capabilities of the Adversary

Assuming that the adversary knows that an anomaly detection system is deployed
on the targeted network, the adversary can modify their traffic such that it
mimics the normal network traffic of the targeted network and avoids the
detection by the anomaly detection system. We impose a constraint that the
adversary does not know what kind of models were used within the anomaly
detection system.

###  1.3 Outline of Paper

The rest of this paper is structured as follows: we first provide the
intuition behind our encoding in Section 2. Then we list some related works in
Section 3. In Section 4, we describe our NetFlow encoding algorithm. Then in
Section 5, we describe our procedure in how we evaluate our new algorithm and
the results of our evaluation. Finally, we conclude this paper in Section 6.

##  2 Encoding Intuition

We believe that the context and frequency of a unique feature value contain
information on what type of network behaviour is occurring in a flow. We will
now illustrate this with an example. Say we have NetFlow data and we have
extracted the frequency of the following byte values: 37, 39, 80, 81 and
37548. The frequencies of the byte values are presented in Table 1. From these
bytes values, we see that byte values 80 and 81 differ only by one byte in
size but there is a large difference in their frequencies. This likely means
they are generated by different kinds of software and therefore should be
treated differently by machine learning methods.

Using a NetFlow preprocessing technique such as the one that is used in[9],
the space of the byte values can be divided into three regions; 37 and 39, 80
and 81 and 37548. Though there is a large difference between the frequencies
of byte values 80 and 81, they are still put within the same region. This
leads to machine-learning methods treating these two values as similar. Using
our encoding algorithm, we would create different separations within the space
of the byte values: All byte values with a very low frequency are put together
into one region, while byte values 80 and 81 are put into their own region.

Table 1: Frequencies of byte values 37, 39, 43, 80 and 81. Frequencies of the byte values are extracted from a subset of data from the UGR-16 dataset Byte Value | Frequency
---|---
37 | 1
39 | 4
80 | 24771
81 | 3158
37548 | 4

##  3 Related Works

In this section, we list some works that are related to the work done in this
paper. We present some of the pre-processing techniques that have been used to
process NetFlow data.

One approach to pre-process NetFlow data is to normalise the (non-categorical)
numerical feature data using the Z-score method [13, 26, 28], a method that
scales the data for a numerical feature to a value between 0 and 1. The
normalisation removes the large differences in the feature data as these could
have a large impact on model prediction results. With the normalisation, each
feature would have an equal impact on the model prediction results. As this
method tries to give each feature an equal impact on the model prediction
results, you might lose information on the network behaviour that has occurred
in the flow; the normalisation is done by first finding the mean of the
feature values for a given feature. This assumes that there is an average
behaviour shared between all hosts in the network. This might not be true,
especially when there are many different users on the network; each user would
behave differently and the behaviour would occur in a particular context. Thus
using this method, the context of the behaviour will be lost and therefore
lose some behavioural information.

Another approach to pre-process NetFlow data is to use different methods to
rank and select features for the learning of the model [23, 25, 30]. These
methods reduce the number of features that are used for the learning of the
model and only the features that provide the most contribution to the model
prediction results are used. However, these methods do not explicitly use the
frequencies and context of the feature values to create an encoding for each
flow.

Besides the normalisation approach and the feature selection approach, there
also exist methods that can be used to encode numerical feature values [9, 15,
22]. These methods split the space of the numerical feature into different
bins and encode each feature value based on the bin that which it belongs,
ignoring their frequency and context.

Furthermore, it is also possible to compute aggregated features from the
existing features of the NetFlow data and use these aggregated data to learn a
model [6, 12, 20, 21]. Computing these aggregated can be used to derive new
information from the dataset that could aid with the learning of a more
accurate model. In our work, we also compute new aggregated features that can
be used to derive the context in which a particular feature value occurs and
use the new features to learn a model. Compared to the work that is done in
[6, 12, 20, 21], we do not compute as many aggregated features and there is no
overlap in the aggregated features that we have computed. Furthermore, [6, 12,
20, 21] do not explicitly use the frequencies of the feature values as an
aggregated feature and no encoding is applied to the feature data.

##  4 Encoding Algorithm

In this section, we describe our encoding algorithm for NetFlow data. We
explain the intuition behind our encoding algorithm and how our algorithm
creates an encoding for a NetFlow dataset.

###  4.1 Computing the Context

Our idea to compute the context for the values of a given NetFlow Feature is
inspired by the work of Word2Vec, especially the Count Bag of Words (CBOW)
method [17]. For each value $v$ of a given non-categorical NetFlow feature
$f$, we want to compute the context in which $v$ occurs in by computing the
frequency of the values that occurred before $v$ and the frequency of the
values that occurred after $v$. The intuition is that the frequencies of the
previous/next values capture the behaviour of a given feature value $v$ within
a network. Using the frequencies of the previous/next values, we generate a
vector for each feature value $v$. Using the (Euclidean) distances between
vectors of the feature values, we can define the context in which a feature
value $v$ occurs; the smaller the distance between two vectors, the more
similar the context in which two feature values occur. This provides us with
the ability to create different groups using the context.

###  4.2 Creating the Encoding

As we can use the distances of the vectors to define the context of each
unique feature value $v$, we can use these vectors to group similar (unique)
feature values together. The encoding for the feature values can be created by
clustering the vectors of the feature values and using the cluster number that
a $v$ was assigned to as the encoding for $v$. Similar feature values that
occur in a similar context would therefore be assigned to the same cluster and
would get the same encoding.

###  4.3 Implementation of Our Encoding Algorithm

As we are clustering the vectors to create the encoding, the length of the
vectors must be equal for all feature values. As each feature value $v$ would
have a different set of previous/next values, we need to have a generalised
structure for the vector. During the implementation of our encoding algorithm,
we have experimented with different methods in how to construct the vectors
for each feature value $v$ of a given NetFlow feature $f$.

For our first method, we used a method that is similar to Word2Vec; we used a
vector to store the frequency of all possible previous/past values, including
the frequency of $v$ itself. For the second method, we applied a time series
differencing method to the values before computing the frequencies. The main
issue with these two methods is that we are creating very large vectors to
store the frequencies and we do not have control over the size of the vectors.

To resolve this issue, we have decided to divide the space of the previous and
next values into ten bins each using percentiles. This way we have a much
smaller vector for each feature value $v$. For this method, we check which bin
a previous/next value falls into and increment the frequency of the
corresponding bin. We have included two entries in the vector to store the
previous self-frequency and the next self-frequency. The self-frequency refers
to the frequency in which $v$ has itself as its previous/next value. With this
third method, we reduced the size of the vector and the structure is
generalised for each unique feature value $v$ Furthermore, we also have
control over the sizes of the vectors that we create for the unique value
values.

Figure 1 provides a high-level overview of our data processing pipeline. For
the clustering of the vectors, we have used the KMeans Clustering
implementation that is provided by Scikit-learn machine-learning package [5].
We opted to use KMeans clustering to cluster the vectors as we can fix the
number of clusters that can be created and thus we can fix the size of our
encoding.

Figure 1: High-level overview of our data processing pipeline. The pipeline
shows how the encoding is created for the given NetFlow input data using our
encoding algorithm.

##  5 Evaluation & Results

In this section, we describe how we applied our encoding algorithm to learn a
state machine model for anomaly detection. Furthermore, we also provide a
comparison of the performance results of our state machine model against
existing works that use the same datasets.

###  5.1 State-machine Learning Framework

In this work, we have used our encoding algorithm to pre-process NetFlow data
for the learning of state machine models. A state machine or automaton is a
mathematical model that is used to model the sequential behaviour of a system.

State machine models can be learned from trace data that are produced by a
system. For this work, we have chosen to use Flexfringe [27] as the state-
machine learning framework to learn the state machine models in an
unsupervised manner for anomaly detection. We have chosen this particular
framework as it provides the ability to use different heuristics for the
learning of the models.

###  5.2 Dataset Selection

To evaluate our approach in this work, we have used three different datasets
to learn our models and for anomaly detection. For the first dataset, we have
used a dataset that we created for the AssureMOSS project [2]. This dataset
contains both benign and malicious NetFlows gathered from a Kubernetes cluster
running multiple applications [3]. The architecture of the cluster is
presented in Figure 2. For the generation of this dataset, 20 participants
were asked to use the applications to generate benign NetFlow data.
Furthermore, three different attack scenarios were constructed using a threat
matrix proposed by Microsoft [16]. The attack scenarios were launched by
ourselves against the cluster, while the participants were using the
applications.

For the second dataset, we have selected a well-known data that is used by
many works; the CTU-13 dataset [11]. This dataset contains both benign network
traffic data that was generated by real users and malicious network traffic
data that was generated by different malware. This dataset contains thirteen
captures of different malware samples.

For the third dataset, we have selected the UGR-16 dataset [14]. This dataset
contains a large volume of NetFlows collected from a Spanish ISP. The benign
data were produced by real users and different types of attacks were launched
to generate the malicious data.

Figure 2: Architecture of the Kubernetes Cluster that was used to generate the
AssureMOSS dataset

###  5.3 Feature Selection

For each dataset, we used the same set of features to pre-process the NetFlow
data for learning the state machine models; the protocol that was used in a
flow, the total number of bytes that were sent in a flow and the duration of
the flow. Using only these three features, our approach does not rely on
operating system/network-specific features and our approach can be used on
different types of networks. Furthermore, our approach is less privacy
intrusive as we are using as few as possible features to train our models.

###  5.4 Encoding Train & Test Data

In our approach, we have only used benign NetFlow data to learn the state
machine models. For the CTU-13 dataset, we have used the split that the
authors of the dataset have proposed in [11] to create our train and test set.
For the UGR-16 dataset, we created our train set using benign data from the
first week of each month in the calibration data and we create our test using
both benign and malicious data from the first week of each month from the test
data. For the AssureMOSS data, we have selected the benign data from the first
half-hour of data to create our training data and the remaining data is used
to create the test data.

Once the train and test set has been created for each dataset, the train and
test set are concatenated together to create a larger set to be used as input
for our encoding algorithm. Once the encoding has been created from this set,
the encoding is added to the train and test set as extra columns.

###  5.5 Creating Traces for Flexfringe

To learn a model with Flexfringe, the tool expects us to provide a list of
traces as input. Each trace consists of a list of symbols. To transform the
train and test set into the input format of the tool, we have used a sliding
window to create the traces for the train and test set. Each flow is
transformed into a symbol and it is created by concatenating the encoding of
the selected features together to form a single string with the following
form: $PROTOCOL\\_BYTES\\_DURATION$. Note that the protocol feature is already
categorical, therefore we do not need to run our encoding algorithm on this
feature. However, we did use an integer encoding that converts each protocol
to a numerical value. For the creation of traces, we first sort the NetFlow
data based on the connections (i.e. combination of source and destination
host) and we drop traces that have a length smaller than the size of the
sliding window. We drop the short traces as we deem these traces to not
provide enough information on the sequential behaviour that is occurring in
the network.

###  5.6 Detecting Anomalies using State Machines

Once we have learned a state machine from the benign training data, we can use
the model to compute probabilities for the traces in the test set. We flag a
trace as an anomaly when the probability of the given trace is lower than the
set threshold. The threshold is set by using the following formula:
$threshold=\mu_{train}+\delta\cdot\sigma_{train}$, where $\mu_{train}$ is the
average probability of the train traces, $\delta$ is a dataset dependent
factor and $\sigma_{train}$ is the standard deviation of the train traces. The
intuition behind this formula is to check whether the probability of a trace
deviates more than $\delta$ times the standard deviation from the average
probability of the traces that were seen during training. If so, then this
trace is considered to have a large deviation and will be flagged as an
anomaly.

###  5.7 Results

The performance results of our approach on the AssureMOSS dataset, the CTU-13
dataset and the UGR-16 dataset are shown in Table 2,3, and 5 respectively. For
the CTU-13 and the UGR-16 dataset, we have listed the performance of some of
the existing works that used the same dataset. The AssureMOSS dataset is new
and has not been used in any existing works yet, therefore we have compared it
to two other anomaly detection methods provided by the scikit-learn machine-
learning package [1]. For each dataset, we also compared the performance of
the different encoding methods that can be used to pre-process the NetFlow
data for state-machine learning; the contextual frequency encoding is the
encoding that we propose in this work, the percentile encoding creates bins
for the selected non-categorical features and the frequency encoding create a
unique label for a feature value if the frequency for the value occurred more
than one thousand times in the data. Feature values that do not occur more
than one thousand times will be put into bins just like percentile encoding.

Table 2: Performance results of our approach on AssureMOSS dataset Method |  | Learning
---
Category
Encoding | Accuracy | $F_{1}$ | Prec. | Rec.
Our Approach |  Unsupervised Learning |  | Contextual
---
Frequency
0.989 | 0.976 | 0.960 | 0.992
Percentile | 0.836 | 0.727 | 0.572 | 0.999
Frequency | 0.842 | 0.682 | 0.611 | 0.773
| Isolation
---
Forest
| Unsupervised
---
Learning
- | 0.594 | 0.0006 | 0.0006 | 0.0006
| Local Outlier
---
Factor
| Unsupervised
---
Learning
- | 0.551 | 0.060 | 0.055 | 0.067

####  5.7.1 AssureMOSS dataset

Table 2 shows that our state machine models can achieve very high-performance
results when we use our encoding algorithm to pre-process the NetFlow data.
Our approach of using state machine models has a significantly better
performance than an isolation forest and a local outlier factor in the task of
detecting anomalies. Both the isolation forest and the local outlier factor
were trained using the default configuration. All models were trained using
the same set of features. When comparing the different encoding methods that
were used to pre-process the data, we that our encoding algorithm provides the
best results.

####  5.7.2 CTU-13 Dataset

When looking at the results in Table 3, It is interesting to note that using
the frequency encoding provided us with the best results on this dataset. Our
encoding algorithm and the percentile encoding achieved similar performance.
This result shows that we did not use enough clusters in our encoding
algorithm when we were encoding this dataset. The frequency encoding
introduces a new unique symbol when a feature value occurs often enough. This
can create a larger alphabet of different symbols when compared to the
encoding that is created by our algorithm. Investigating the prediction
results of the model that used our encoding shows that this reasoning is
correct; many of the infrequent feature values were put into a large cluster,
making this cluster number (and thus also the symbol) to be seen as a frequent
symbol by the state machine model. This caused many malicious flows to get a
very high probability of occurring and consequently it does not raise an alarm
as it does not exceed the threshold. Furthermore, we have noticed that many of
the benign traces that were flagged malicious by our approach are traces that
were produced by connections that have just enough flows to produce one single
trace. This caused our model to give a low probability to these traces. We
expect to achieve better results with our encoding if we increase the number
of clusters that can be formed and if we have more traces for the benign
connections that have a low number of flows in the test data.

When we compare the results of our approach to existing works that used the
same dataset and that have learned their model supervised manner (or an
ensemble), we see that we do not perform as well. However, these works use
more than three features and information regarding the source ports of the
flows is used for the learning of the model. We strongly believe that the
source port feature extracted from this dataset should not blindly be used to
learn the model as the source port of a flow leaks information on the label of
flow; the original authors of the dataset used virtual machines that were
running Windows XP to generate the malicious flows of the malware. For this
operating system, the default ephemeral ports start at 1025 and end at 5000
[4]. When we plot the distribution of the protocols for both benign and
malicious data we can see a clear difference in the distributions of the
source ports. Figure 3 presents the distribution of the source ports for the
benign and malicious flows from all scenarios. From the distribution of the
source ports of the malicious data, a large portion of the flows seems to use
a source port that is lower than 6000. The top three ports used in the
malicious flows are 2077, 1025 and 2079. All these three port numbers fall
within the range used by the virtual machines. Thus using the source port
number, the model does not try to learn whether it can distinguish malicious
flows from benign flows but rather whether it can distinguish flows coming
from a virtual machine or not. Thus, using the source port information to
train the model would falsely lead to a better performance of the model.

(a) Source port distribution
of benign flows

(b) Source port distribution
of malicious flows

Figure 3: The distribution of the source port for the benign and malicious
flows of the CTU-13 dataset.

In our approach, we train our models in an unsupervised manner with only
benign data and using only three features. Furthermore, we do not use any
source port information to train our model. When we use the frequency encoding
to learn a state machine model, we achieve similar results that were achieved
by [7]. We expect that by using a larger number of clusters for our encoding
algorithm we can also achieve similar results that were achieved by [7]

When we compare our approach to an existing work [29] that also used an
unsupervised approach to detect anomalies, we see that our approach is not as
accurate but we do achieve a much higher $F_{1}$ score. This work also used
three features from the dataset to learn their model; the duration of the
flow, the number of bytes sent by the source host within a flow and the type
of service of the destination host. Only one of the features is in common
between this work and our work.

Additionally, we have compared our work to the work that was done in [8]. The
performance results are presented in Table 4. As this work tries to label
source hosts instead of labelling flow, we needed to change our evaluation
method for the comparison. In our evaluation for this comparison, we compute
for each source host how many connections it has made that are flagged as
anomalies and how many connections it has made are flagged as benign. If a
source host has produced less than 1000 flows, then we mark this source host
as benign as we do not have enough information to conclude whether this host
is malicious or not. If a source host has produced at least one thousand flows
and if at least 25% of the connections that were made by a source host are
flagged anomalous, then we mark this source host as malicious. When we compare
our results to the results of BotFP, we see that our approach is as accurate
as BotFP but we have a lower $F_{1}$ and precision score. The low performance
on these two metrics can be explained by the same issue that we encountered
when we compared our performance results to other existing works that used the
CTU-13 dataset; many benign source hosts did not produce many flows. We have
added the criteria to mark source hosts as benign if they have not produced at
least one thousand flows, but with this criteria, our approach still produced
more false positives. This causes us to achieve a lower precision score. For
the work that is done in [8], the authors do use the source port information
for their model but the authors have argued that the statistical difference in
the operating systems between the host machines is an interesting feature to
detect botnets.

####  5.7.3 UGR-16 Dataset

When looking at the performance results that we have achieved with our
approach on the UGR-16 dataset, we see that our encoding algorithm provides us
with the best results compared to the percentile and the frequency encoding.

When we compare the results of our approach to existing works that use the
same dataset, we see that we do not achieve an accuracy as high as the other
works. However, our approach does provide achieve higher performance results
than the work that was done in [30] and [15] when we compare based on the
$F_{1}$ score and the recall score. For the precision score, we achieved
similar results as [30] and [15]. For this dataset, it was a bit difficult to
compare our work to other existing works as they do not always report the same
set of performance metrics. Furthermore, it should be noted again that in our
approach we train our model in an unsupervised manner using only benign data
and three features whereas the existing works mostly train their models in a
supervised manner and used more than three features to train their models.

Table 3: Performance results of our approach on CTU-13 dataset Method |  | Learning
---
Category
Encoding | Accuracy | $F_{1}$ | Prec. | Rec.
Our Approach |  Unsupervised Learning |  | Contextual
---
Frequency
0.815 | 0.825 | 0.908 | 0.756
Percentile | 0.828 | 0.843 | 0.895 | 0.796
Frequency | 0.866 | 0.885 | 0.882 | 0.887
| Ahmed
---
et al [6]
| Supervised
---
Learning
- | 0.996 | - | - | -
| Bansal
---
Mahapatra [7]
| Supervised
---
Learning
- | 0.894 | 0.890 | 0.925 | 0.857
| Haghighat
---
Li [12]
Ensemble | - | 0.999 | 0.999 | 0.999 | 0.999
| Nugraha
---
et al [21]
| Supervised
---
Learning
- | 0.986 | 0.977 | 0.995 | 0.960
| Zoppi
---
et al [29]
| Unsupervised
---
Learning
- | 0.990 | 0.22 | - | -
Table 4: Performance results of our approach compared to BotFP on CTU-13 dataset Method |  | Learning
---
Category
Encoding | Accuracy | $F_{1}$ | Prec. | Rec.
Our Approach |  Unsupervised Learning |  | Contextual
---
Frequency
0.999 | 0.823 | 0.700 | 1.0
Percentile | 0.999 | 0.823 | 0.700 | 1.0
Frequency | 0.999 | 0.823 | 0.700 | 1.0
| Blaise
---
et al [8]
| Supervised and
---
Unsupervised
- | 0.999 | 0.930 | 0.930 | 0.930
Table 5: Performance results of our approach on UGR-16 dataset Method |  | Learning
---
Category
Encoding | Accuracy | $F_{1}$ | Prec. | Rec.
Our Approach |  Unsupervised Learning |  | Contextual
---
Frequency
0.936 | 0.929 | 0.932 | 0.926
Percentile | 0.652 | 0.487 | 0.739 | 0.364
Frequency | 0.527 | 0.658 | 0.491 | 0.999
| Larriva-Novo
---
et al [13]
| Supervised
---
Learning
- | 0.996 | - | - | -
| Magan-Carrion
---
et al [15]
| Supervised
---
Learning
- | - | 0.888 | 0.897 | 0.887
| Rajagopal
---
et al [24]
| Ensemble of
---
Supervised and
Unsupervised
- | 0.972 | - | 0.981 | 0.988
| Zoppi
---
et al [30]
Meta-Learning | - | 0.980 | 0.540 | 0.956 | 0.377

It should be noted that in our approach we drop traces that do not have the
same length as the length of the sliding that was used. As we sort the flows
based on the connections, there could be many connections that do not have
enough flows to create traces that have the same length as the sliding window.
This means that we miss benign data that could be used to train our model and
we might mislabel malicious flows from shorter connections. This could affect
the performance of our models negatively.

###  5.8 Evading Detection of our Models

For our approach, we learn state machine models from NetFlow data and use them
to detect anomalies within a network. By looking at the (log-likelihood)
probability plots that we have generated using our state machine models, we
can already see the large deviation in the network behaviour for the malicious
data. Figure 4, 5 and 6 present the plots of the probabilities of the traces
from the AssureMOSS, CTU-13 and the UGR-16 dataset respectively. We have
coloured the benign traces in blue and the malicious traces in red to make it
easier for the reader to see which traces in the test set are the malicious
traces. Furthermore, it should be noted that a higher peak in the plot means a
lower probability for a given trace to occur.

We now want to reflect on how an adversary can evade detection by our models.
Our models can already detect the large deviation in the network behaviour
using only three features from the NetFlow datasets to train our models. We
argue that it is hard for an adversary to avoid our anomaly detection method
if it is deployed on different networks. As we are using three features
(duration, protocol and number of bytes sent) to train our models, an
adversary can try to avoid detection by mimicking the values that were
produced by benign hosts within a network for these three features. This could
be a very hard task as not only would an adversary need to know the normal
network behaviour (and this is different for each network), but the adversary
would also need to produce network traffic in such a way that the feature
values occur within the contexts of the feature values produced by normal
network behaviour. Failing to do so, our encoding algorithm will give a
different encoding to the traffic produced by the adversary and our models
will detect this deviation.

Though it is difficult, an adversary can still evade detection by our
approach. In our approach, we drop traces that do not have the same size as
the size of the sliding window that we have used to create the traces. As we
are sorting the NetFlow data based on the connections before the traces are
created, an adversary can bypass our approach by creating many small
connections to different destination hosts. However, we argue that it is also
possible for us to sort the data differently and we would detect the traffic
that is produced by the adversary.

Another way how the adversary can evade our detection by our approach is by
producing traffic in such a way that our encoding algorithm would put it in
the large cluster of infrequent unique feature values. An example of this
large cluster was seen in our investigation of our performance results on the
CTU-13 dataset. Being able to create traffic that will be put within this
large cluster by our encoding algorithm, the state machine model would assign
very high probabilities to the corresponding traces and therefore evade
detection. We aim to further investigate how to correctly handle such
infrequently occurring values in future work.

(a) Train traces

(b) Test traces

Figure 4: Probabilities of the train and test traces for the AssureMOSS
dataset. The higher the peak, the lower the probability for a given trace to
occur. Benign traces are coloured in blue and the malicious traces are
coloured in red.

(a) Train traces

(b) Test traces

Figure 5: Probabilities of the train and test traces for the CTU-13 dataset.
The higher the peak, the lower the probability for a given trace to occur.
Benign traces are coloured in blue and the malicious traces are coloured in
red.

(a) Train traces

(b) Test traces

Figure 6: Probabilities of the train and test traces for the UGR-16 dataset.
The higher the peak, the lower the probability for a given trace to occur.
Benign traces are coloured in blue and the malicious traces are coloured in
red.

##  6 Conclusion & Future Work

###  6.1 Conclusion

In this work, we presented an encoding algorithm that can be used to pre-
process a NetFlow dataset for machine learning. The encoding algorithm
directly uses the frequency of the feature values to compute a context in
which the feature values occur. The context is then used to group feature
values to create an encoding for the given feature. The intuition is that
feature values that occur within a similar context will get the same encoding.
We show an application of our encoding algorithm by using it to pre-process
three different NetFlow datasets and then use the encoded data to learn state
machine models for anomaly detection. For each dataset, we have computed our
performance results and compared them to existing works that used the same
dataset. From the comparison, we notice that our approach is not as accurate
as existing works that use the CTU-13 and the UGR-16 dataset. However, these
typically use supervised learning setups with many more features. Our approach
does outperform some of the existing works based on the $F_{1}$, precision and
recall scores.

###  6.2 Future Work

While investigating our performance on the CTU-13 dataset, we have noticed
that our encoding algorithm produces a very large cluster in which all
infrequent feature values are put. This is a behaviour that we want to capture
with our encoding but it does not work for feature values that occur
infrequently in the train set and frequently in the test set. As it occurs
frequently in the test set, the symbol that is used to represent this large
cluster will appear more often in the test traces and the state machine model
would give this symbol a very high probability for it to occur. This would
then raise many false negatives. As one of our future works, we want to
investigate how we can deal with this issue in our encoding and for the
learning of the state machine models.

For this work, we have only used NetFlow. For future work for our encoding
algorithm, we would like to evaluate it on other types of data e.g. software
log data. We believe that our encoding could also be beneficial for encoding
software log data and it would also be interesting to compare our encoding
algorithm to existing works that are used to process software log data.

## Acknowledgment

This work is funded under the Assurance and certification in secure Multi-
party Open Software and Services (AssureMOSS) Project,
(https://assuremoss.eu/en/), with the support of the European Commission and
H2020 Program, under Grant Agreement No. 952647.

## References

  * [1] 2.7. Novelty and Outlier Detection — scikit-learn 1.1.1 documentation, https://scikit-learn.org/stable/modules/outlier_detection.html
  * [2] AssureMOSS, https://assuremoss.eu/en/
  * [3] Assuremoss netflow dataset for anomaly detection, https://surfdrive.surf.nl/files/index.php/s/CV2fOFlbtsADX9z
  * [4] Service overview and network port requirements - Windows Server — Microsoft Docs, https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements
  * [5] sklearn.cluster.KMeans — scikit-learn 1.1.1 documentation, https://scikit-learn.org/stable/modules/generated/sklearn.cluster.KMeans.html
  * [6] Ahmed, A.A., Jabbar, W.A., Sadiq, A.S., Patel, H.: Deep learning-based classification model for botnet attack detection. Journal of Ambient Intelligence and Humanized Computing 1, 1–10 (mar 2020). https://doi.org/10.1007/S12652-020-01848-9/FIGURES/12, https://link-springer-com.tudelft.idm.oclc.org/article/10.1007/s12652-020-01848-9
  * [7] Bansal, A., Mahapatra, S.: A Comparative Analysis of Machine Learning Techniques for Botnet Detection. Proceedings of the 10th International Conference on Security of Information and Networks (2017). https://doi.org/10.1145/3136825, https://doi.org/10.1145/3136825.3136874
  * [8] Blaise, A., Bouet, M., Conan, V., Secci, S.: Botnet Fingerprinting: A Frequency Distributions Scheme for Lightweight Bot Detection. IEEE Transactions on Network and Service Management 17(3), 1701–1714 (sep 2020). https://doi.org/10.1109/TNSM.2020.2996502
  * [9] Camacho, J., Macia-Fernandez, G., Fuentes-Garcia, N.M., Saccenti, E.: Semi-supervised multivariate statistical network monitoring for learning security threats. IEEE Transactions on Information Forensics and Security 14(8), 2179–2189 (aug 2019). https://doi.org/10.1109/TIFS.2019.2894358
  * [10] Cisco Systems: Cisco IOS NetFlow - Cisco. https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html (2018)
  * [11] Garcia, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Computers & Security 45, 100–123 (sep 2014). https://doi.org/10.1016/J.COSE.2014.05.011
  * [12] Haghighat, M.H., Li, J.: Intrusion detection system using voting-based neural network. Tsinghua Science and Technology 26(4), 484–495 (aug 2021). https://doi.org/10.26599/TST.2020.9010022
  * [13] Larriva-Novo, X., Vega-Barbas, M., Villagrá, V.A., Rivera, D., Álvarez-Campana, M., Berrocal, J.: Efficient Distributed Preprocessing Model for Machine Learning-Based Anomaly Detection over Large-Scale Cybersecurity Datasets. Applied Sciences 2020, Vol. 10, Page 3430 10(10), 3430 (may 2020). https://doi.org/10.3390/APP10103430, https://www.mdpi.com/2076-3417/10/10/3430/htmhttps://www.mdpi.com/2076-3417/10/10/3430
  * [14] Maciá-Fernández, G., Camacho, J., Magán-Carrión, R., García-Teodoro, P., Therón, R.: UGR‘16: A new dataset for the evaluation of cyclostationarity-based network IDSs. Computers and Security 73, 411–424 (mar 2018). https://doi.org/10.1016/j.cose.2017.11.004
  * [15] Magán-Carrión, R., Urda, D., Díaz-Cano, I., Dorronsoro, B.: Towards a Reliable Comparison and Evaluation of Network Intrusion Detection Systems Based on Machine Learning Approaches. Applied Sciences 2020, Vol. 10, Page 1775 10(5), 1775 (mar 2020). https://doi.org/10.3390/APP10051775, https://www.mdpi.com/2076-3417/10/5/1775/htmhttps://www.mdpi.com/2076-3417/10/5/1775
  * [16] Microsoft: Threat matrix for Kubernetes (2020), https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  * [17] Mikolov, T., Chen, K., Corrado, G., Dean, J.: Efficient estimation of word representations in vector space. In: 1st International Conference on Learning Representations, ICLR 2013 - Workshop Track Proceedings. International Conference on Learning Representations, ICLR (jan 2013), http://ronan.collobert.com/senna/
  * [18] Moustafa, N., Slay, J.: UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). 2015 Military Communications and Information Systems Conference, MilCIS 2015 - Proceedings (dec 2015). https://doi.org/10.1109/MILCIS.2015.7348942
  * [19] of New Brunswick, U.: Datasets — Research — Canadian Institute for Cybersecurity — UNB. https://www.unb.ca/cic/datasets/index.html
  * [20] Nguyen, Q.P., Lim, K.W., Divakaran, D.M., Low, K.H., Chan, M.C.: GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection. 2019 IEEE Conference on Communications and Network Security, CNS 2019 pp. 91–99 (jun 2019). https://doi.org/10.1109/CNS.2019.8802833
  * [21] Nugraha, B., Nambiar, A., Bauschert, T.: Performance Evaluation of Botnet Detection using Deep Learning Techniques. Proceedings of the 11th International Conference on Network of the Future, NoF 2020 pp. 141–149 (oct 2020). https://doi.org/10.1109/NOF50125.2020.9249198
  * [22] Pellegrino, G., Lin, Q., Hammerschmidt, C., Verwer, S.: Learning behavioral fingerprints from Netflows using Timed Automata. In: Proceedings of the IM 2017 - 2017 IFIP/IEEE International Symposium on Integrated Network and Service Management. pp. 308–316. Institute of Electrical and Electronics Engineers Inc. (jul 2017). https://doi.org/10.23919/INM.2017.7987293
  * [23] Piskozub, M., Spolaor, R., Martinovic, I.: MalAlert: Detecting malware in large-scale network traffic using statistical features. In: Performance Evaluation Review. vol. 46, pp. 151–154 (2019). https://doi.org/10.1145/3308897.3308961
  * [24] Rajagopal, S., Kundapur, P.P., Hareesha, K.S.: A Stacking Ensemble for Network Intrusion Detection Using Heterogeneous Datasets. Security and Communication Networks 2020 (2020). https://doi.org/10.1155/2020/4586875, https://doi.org/10.1155/2020/4586875
  * [25] Shamshirband, S., Chronopoulos, A.T.: A new malware detection system using a high performance-elm method. ACM International Conference Proceeding Series (jun 2019). https://doi.org/10.1145/3331076.3331119, https://doi.org/10.1145/3331076.3331119
  * [26] Terzi, D.S., Terzi, R., Sagiroglu, S.: Big data analytics for network anomaly detection from netflow data. In: 2nd International Conference on Computer Science and Engineering, UBMK 2017. pp. 592–597. Institute of Electrical and Electronics Engineers Inc. (oct 2017). https://doi.org/10.1109/UBMK.2017.8093473
  * [27] Verwer, S., Hammerschmidt, C.A.: Flexfringe: A passive automaton learning package. In: Proceedings - 2017 IEEE International Conference on Software Maintenance and Evolution, ICSME 2017. pp. 638–642 (2017). https://doi.org/10.1109/ICSME.2017.58
  * [28] Yilmaz, I., Masum, R.: Expansion of Cyber Attack Data From Unbalanced Datasets Using Generative Techniques (2019), http://arxiv.org/abs/1912.04549
  * [29] Zoppi, T., Ceccarelli, A., Capecchi, T., Bondavalli, A.: Unsupervised anomaly detectors to detect intrusions in the current threat landscape. ACM/IMS Trans. Data Sci. 2(2) (apr 2021). https://doi.org/10.1145/3441140, https://doi.org/10.1145/3441140
  * [30] Zoppi, T., Gharib, M., Atif, M., Bondavalli, A.: Meta-learning to improve unsupervised intrusion detection in cyber-physical systems. ACM Transactions on Cyber-Physical Systems 5(4) (sep 2021). https://doi.org/10.1145/3467470, https://dl-acm-org.tudelft.idm.oclc.org/doi/abs/10.1145/3467470