Abstract:With information technology entering new fields and levels of deployment, e.g., in areas of energy, mobility, and production, network security monitoring needs to be able to cope with those environments and their evolution. However, state-of-the-art Network Security Monitors (NSMs) typically lack the necessary flexibility to handle the diversity of the packet-oriented layers below the abstraction of TCP/IP connections. In this work, we advance the software architecture of a network security monitor to facilitate the flexible integration of lower-layer protocol dissectors while maintaining required performance levels. We proceed in three steps: First, we identify the challenges for modular packet-level analysis, present a refined NSM architecture to address them and specify requirements for its implementation. Second, we evaluate the performance of data structures to be used for protocol dispatching, implement the proposed design into the popular open-source NSM Zeek and assess its impact on the monitor performance. Our experiments show that hash-based data structures for dispatching introduce a significant overhead while array-based approaches qualify for practical application. Finally, we demonstrate the benefits of the proposed architecture and implementation by migrating Zeek's previously hard-coded stack of link and internet layer protocols to the new interface. Furthermore, we implement dissectors for non-IP based industrial communication protocols and leverage them to realize attack detection strategies from recent applied research. We integrate the proposed architecture into the Zeek open-source project and publish the implementation to support the scientific community as well as practitioners, promoting the transfer of research into practice.

Dmns : A Framework to Dynamically Monitor Simulated Network

On the Simulation of Networked Sensor Systems.

Mc2: Multimode User-Centric Design of Wireless Sensor Networks for Long-Term Monitoring

Development and Application of Networked Structural Laboratories System in Current Hierarchical Network Environment

Development of Simulation Environment WSNSim for Wireless Sensor Networks

Status Monitoring and Fault Diagnosis Network System Based on Universal Plug and Play

SimMon: a toolkit for simulation of monitoring mechanisms in cloud computing environment.

The Development of a Realistic Simulation Framework with OMNeT++

An Agent-Based Monitoring Framework for Distributed Complex Engineering Simulation System

SimMon: A Toolkit for Simulating Monitoring Mechanism in Cloud Computing Environments.

Distributed Collaborative Monitoring in Software Defined Networks

Advancing Protocol Diversity in Network Security Monitoring

DHYMON: a Continuous Decentralized Hybrid Monitoring Architecture for MANETs

A new conceptual distributed network measurement architecture based on Web service

Design and Realization of Interactive Network Flow Monitoring System

Newton: Intent-Driven Network Traffic Monitoring

Network Protocol System Monitoring - A Formal Approach with Passive Testing

The Design of Web Service-based Distributed Monitoring System

A Research on Integrated Space-Ground Information Network Simulation Platform Based on SDN

An Extensible Emulation and Network Performance Analysis System for Space Information Network.

An Object-Oriented Model of Network Performance Monitoring System