Abstract:As the 5G rolls out around the world, many edge applications will be deployed by app vendors and accessed by massive end-users. Efficient detection of malicious network behavior is paid more and more attention. The current traffic detection work is still stuck on the analysis of high-dimensional data. It will restrict the improvement of threat monitoring and network governance when facing massive network flows. Characterization of network flows within simple domains is required to simplify the process of network analysis. Traffic characterization is a key task that allows service providers to detect and intercept anomalous traffic, such that high QoS (Quality of Service) and service availability are maintained and spread of malicious content is prevented. Unfortunately, there is still a lack of research on the concrete characterization of network data. Analogous to spectrum, in this paper, we proposed the concept of FlowSpectrum for the first time in order to represent the network flow, concretely. In the FlowSpectrum, network flow is represented as a spectral line rather than the raw data or a feature vector of the network flow. All flows are able to be mapped as spectral lines, and traffic identification is achieved by analyzing the positions of spectral lines. FlowSpectrum can significantly reduce the complexity of network traffic behavior analysis while enhancing the interpretability of detection and facilitating cyberspace behavior management. We designed a neural network structure based on semi-supervised AutoEncoder for decomposition and dimensionality reduction of network flows in FlowSpectrum. The characterization capability of FlowSpectrum is proved by thorough experiments. Moreover, we realized the correspondence between network behaviors and intervals of spectral lines, preliminarily. Generally speaking, FlowSpectrum can provide new ideas for the field of network traffic analysis.

Seeflow: A Visualization System Using 2T Hybrid Graph for Characteristics Analysis of Abnormal Netflow

An Interactive Visualization System for Network Security Data

A flow-based anomaly detection method using sketch and combinations of traffic features

A Visualization System for Multiple Heterogeneous Network Security Data and Fusion Analysis.

A novel spread estimation based abnormal flow detection in high-speed networks

Research on Flow Anomaly Detection Technology Based on NetFlow

A NetFlow based flow analysis and monitoring system in enterprise networks

NetSecRadar: A Visualization System for Network Security Situational Awareness

The Global Flow Table Based on the Software-Defined Networking

FlowSpectrum: a concrete characterization scheme of network traffic behavior for anomaly detection

Monitoring Abnormal Network Traffic Based on Blind Source Separation Approach

A Matrix-Based Visualization System for Network Traffic Forensics

Efficient and Accurate Flow Record Collection With HashFlow

A Network Visualization System for Anomaly Detection and Attack Tracing.

Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis

Multi-scale Entropy Based Traffic Analysis and Anomaly Detection

A Quick and Feature based Visualization Algorithm for Large-scale Flow Data.

Exploring Network-Wide Flow Data with Flowyager

DeepFlow: Abnormal Traffic Flow Detection Using Siamese Networks

Scalable Network Traffic Visualization Using Compressed Graphs.

Superflows: A New Tool for Forensic Network Flow Analysis