LENTA: Longitudinal Exploration for Network Traffic Analysis
30th International Teletraffic Congress (ITC 30), Vienna, Austria, (2018)Abstract
In this work, we present LENTA (Longitudinal Exploration for Network Traffic Analysis), a system that allows the network analyst to easily identify traffic generated by services and applications running on the web, being them benign or possibly malicious. First, LENTA simplifies analysts job by letting them observe few hundreds of clusters instead of the original hundred thousands of single URLs. Second, it implements a self-learning methodology, where a semi-supervised approach lets the system grow its knowledge, which is used in turn to automatically associate traffic to previously observed services and identify new traffic generated by possibly suspicious applications. This lets the analyst easily observe changes in the traffic, like the birth of new services, or unexpected activities. We follow a data driven approach, running LENTA on real data. Traffic is analyzed in batches of 24-hour worth of traffic. We show that LENTA allows the analyst to easily understand which services are running on its network, highlights malicious traffic and changes over time, greatly simplifying the view and understanding of the traffic.
Links and resources
Tags
community
@itc's tags highlighted