D 2019

Behavior-Aware Network Segmentation using IP Flows

SMERIGA, Juraj and Tomáš JIRSÍK

Basic information

Original name

Behavior-Aware Network Segmentation using IP Flows

Authors

SMERIGA, Juraj and Tomáš JIRSÍK

Edition

ACM. New York, NY, USA, Proceedings of the 14th International Conference on Availability, Reliability and Security, p. 1-9, 9 pp. 2019

Publisher

ACM

Other information

Language

English

Type of outcome

Proceedings paper

Country of publisher

United States of America

Confidentiality degree

is not subject to a state or trade secret

Publication form

electronic version available online

References:

URL

Marked to be transferred to RIV

Yes

RIV identification code

RIV/00216224:14610/19:00110502

Organization

Ústav výpočetní techniky – Repository – Repository

ISBN

978-1-4503-7164-3

EID Scopus

2-s2.0-85071723784

Keywords (in Czech)

IP flows; strojové učení; segmentace sítě; shluková analýza; behaviorální analýza

Keywords in English

IP flows; machine learning; network segmentation; clustering; classification; behavior analysis

Links

EF16_019/0000822, research and development project.
Changed: 9/9/2020 03:20, RNDr. Daniel Jakubík

Abstract

In the original language

Network segmentation is a powerful tool for network defense. In contemporary complex, dynamic, and multilayer networks, network segmentation suffers from lack of visibility into processes in the network, which results in less strict segment definition and loosen network security. Moreover, the dynamics of the networks makes the manual identification of network segments nearly impossible. In this paper, we inspect the possibilities of the behavior-aware network segmentation using IP flows and machine learning approaches that would enable to identify segments automatically, even in a complex network. We evaluate the suitability of clustering algorithms for identification of behavior-consistent segments in a network. We show that the clustering algorithms can identify relevant behavior-consistent clusters that overlap with those identified manually by experts. Apart from the segment identification, we investigate the other essential task of network segmentation process: assignment of an unknown host to an existing segment. We evaluate the performance of four different classification mechanisms on a real-world dataset. We show that it is possible to assign an unknown host to an appropriate network segment with up to 92% precision. Moreover, we release the whole dataset and experiment steps available for public use.
Displayed: 6/5/2026 18:22