Efficient Network Monitoring for Attack Detection

Techniques for network-based intrusion detection have been evolving for years, and the focus of most research is on detection algorithms, although networks are distributed and dynamically managed nowadays. A data processing framework is required that allows to embed multiple detection techniques and to provide data with the needed aggregation levels. Within that framework, this work concentrates on methods that improve the interoperability of intrusion detection techniques and focuses on data preprocessing stages that perform data evaluation and intelligent data filtering. Aer presenting a survey of the chain of processes needed for network-based intrusion detection, I discuss the evaluation of TCP connection states based on aggregated ow data. I develop classifiers that interpret flow data in regard of failed and successful connections. these classifiers are especially relevant for anomaly-based intrusion detection techniques like port scan or malware detection, and enable many of these techniques to operate on flow-level data instead of packet-level data. The second part focuses on the filtering of payload data for Intrusion Detection Sys