Secure And Scalable Anomaly-Based Network Intrusion Detection
summary
A memory-safe network capture framework written in Go decodes packets with gopacket, serializes type-safe audit records as compressed protocol buffers, and writes per-protocol .ncap files; CSV export, Prometheus metrics, and a reverse HTTP proxy fill gaps in IPv6 reassembly. Labeling maps Suricata alerts to records for supervised learning. Experiments on the CIC-IDS-2017 pcaps feed a TensorFlow deep neural network that reports high detection accuracy (claimed ~95–99%). Performance tuning swaps in the gogo protobuf generator for ~2x marshal speed and uses Go + gopacket and Suricata labeling for dataset creation.
AI-written summary · about
chapters (5)
related talks
29mTrust, but Verify: Proactive Security in Open Source
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
58mHunting Malware with Suricata Metadata
26mOptimized Invariant Representation of Network Traffic for Detecting Unseen...
57mHacking with Go
41mState of the Onion
33mFree SOC? — how open source tools can come to our aid
47m Natural Language Processing & Anomaly detection in Sys call logs