A Survey on Network Security Monitoring Systems
---
paper_title: Network Monitoring Approaches: An Overview

paper_content:

Network monitoring and measurement have become more and more ::: important in a modern complicated network. In the past, ::: administrators might only monitor a few network devices or less ::: than a hundred computers. The network bandwidth may be just 10 ::: or 100 Mbps; however, now administrators have to deal with not ::: only higher speed wired network (more than 10 Gbps and ATM ::: (Asynchronous Transfer Mode) network) but also wireless ::: networks. Network administrators are constantly striving to ::: maintain smooth operation of their networks. Network monitoring ::: is a set of mechanisms that allows network administrators to ::: know instantaneous state and long-term trends of a complex ::: computer network. This paper provides the readers with an ::: overview of the current network monitoring approaches, their ::: architectures, features and properties. In addition, it ::: presents a comparison between those approaches.
---
paper_title: Deep Packet Inspection as a Service

paper_content:

Middleboxes play a major role in contemporary networks, as forwarding packets is often not enough to meet operator demands, and other functionalities (such as security, QoS/QoE provisioning, and load balancing) are required. Traffic is usually routed through a sequence of such middleboxes, which either reside across the network or in a single, consolidated location. Although middleboxes provide a vast range of different capabilities, there are components that are shared among many of them. A task common to almost all middleboxes that deal with L7 protocols is Deep Packet Inspection (DPI). Today, traffic is inspected from scratch by all the middleboxes on its route. In this paper, we propose to treat DPI as a service to the middleboxes, implying that traffic should be scanned only once, but against the data of all middleboxes that use the service. The DPI service then passes the scan results to the appropriate middleboxes. Having DPI as a service has significant advantages in performance, scalability, robustness, and as a catalyst for innovation in the middlebox domain. Moreover, technologies and solutions for current Software Defined Networks (SDN) (e.g., SIMPLE [41]) make it feasible to implement such a service and route traffic to and from its instances.
---
paper_title: Commodity Packet Capture Engines: Tutorial, Cookbook and Applicability

paper_content:

Users' demands have dramatically increased due to widespread availability of broadband access and new Internet avenues for accessing, sharing and working with information. In response, operators have upgraded their infrastructures to survive in a market as mature as the current Internet. This has meant that most network processing tasks (e.g., routing, anomaly detection, monitoring) must deal with challenging rates, challenges traditionally accomplished by specialized hardware—e.g., FPGA. However, such approaches lack either flexibility or extensibility—or both. As an alternative, the research community has proposed the utilization of commodity hardware providing flexible and extensible cost-aware solutions, thus entailing lower operational and capital expenditure investments. In this scenario, we explain how the arrival of commodity packet engines has revolutionized the development of traffic processing tasks. Thanks to the optimization of both NIC drivers and standard network stacks and by exploiting concepts such as parallelism and memory affinity, impressive packet capture rates can be achieved in hardware valued at a few thousand dollars. This tutorial explains the foundation of this new paradigm, i.e., the knowledge required to capture packets at multi-Gb/s rates on commodity hardware. Furthermore, we thoroughly explain and empirically compare current proposals, and importantly explain how apply such proposals with a number of code examples. Finally, we review successful use cases of applications developed over these novel engines.
---
paper_title: Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX

paper_content:

Flow monitoring has become a prevalent method for monitoring traffic in high-speed networks. By focusing on the analysis of flows, rather than individual packets, it is often said to be more scalable than traditional packet-based traffic analysis. Flow monitoring embraces the complete chain of packet observation, flow export using protocols such as NetFlow and IPFIX, data collection, and data analysis. In contrast to what is often assumed, all stages of flow monitoring are closely intertwined. Each of these stages therefore has to be thoroughly understood, before being able to perform sound flow measurements. Otherwise, flow data artifacts and data loss can be the consequence, potentially without being observed. This paper is the first of its kind to provide an integrated tutorial on all stages of a flow monitoring setup. As shown throughout this paper, flow monitoring has evolved from the early 1990s into a powerful tool, and additional functionality will certainly be added in the future. We show, for example, how the previously opposing approaches of deep packet inspection and flow monitoring have been united into novel monitoring approaches.
---
paper_title: Ethereal vs. Tcpdump: a comparative study on packet sniffing tools for educational purpose

paper_content:

There are many free packet-sniffing tools available for download. Ethereal and tcpdump are two of the most popular tools among network administrators. This work compares and contrasts the usefulness and appropriateness of these tools for pedagogical purposes. While ethereal is user-friendlier than tcpdump, tcpdump is less intrusive and hence, can be used in a campus-wide network safer, since it does not readily reveal any data transmitted in a packet. Ethereal can be used in a closed networking lab environment to analyze and study many more protocols. Many class assignments can be designed using these two packet sniffers. Particularly, assignments can be developed to analyze tcpdump's output in real-time for intrusion detection or the understanding of a protocol.
---
paper_title: Network forensics analysis using Wireshark

paper_content:

The number and types of attacks against networked computer systems have raised the importance of network security. Today, network administrators need to be able to investigate and analyse the network traffic to understand what is happening and to deploy immediate response in case of an identified attack. Wireshark proves to be an effective open source tool in the study of network packets and their behaviour. In this regard, Wireshark can be used in identifying and categorising various types of attack signatures. The purpose of this paper is to demonstrate how Wireshark is applied in network protocol diagnosis and can be used to discover traditional network attacks such as port scanning, covert FTP and IRC channels, ICMP-based attacks, BitTorrent-driven denial service, and etc. In addition, the case studies in this paper illustrate the idea of using Wireshark to identify new attack vectors.
---
paper_title: Designing snort rules to detect abnormal DNP3 network data

paper_content:

Vulnerability of industrial control network communication protocol is the most important reason leading to industrial control network attacks. In this paper, the vulnerability of DNP3, the typical industrial control network communication protocol, is analyzed. The abnormal behaviors of DNP3 are categorized according to the Snort detection mechanisms. The Snort detection rule template for anomaly DNP3 data is constructed and the rules are designed according the template. The rule designing method can be generally extended to other network-based industrial control protocols.
---
paper_title: Quantitative analysis of intrusion detection systems: Snort and Suricata

paper_content:

Given competing claims, an objective head-to-head comparison of the performance of both the Snort R ::: and Suricata Intrusion Detection Systems is needed. In this paper, we present a comprehensive quantitative comparison of the two ::: systems. We have developed a rigorous testing framework that examines the performance of both systems as we scale ::: system resources. Our results show that a single instance of Suricata is able to deliver substantially higher performance ::: than a corresponding single instance of Snort. This paper describes in detail both the testing framework capabilities, tests ::: performed and results found.
---
paper_title: Bro: A System for Detecting Network Intruders in Real-Time

paper_content:

Abstract We describe Bro, a stand-alone system for detecting network intruders in real-time by passively monitoring a network link over which the intruder's traffic transits. We give an overview of the system's design, which emphasizes high-speed (FDDI-rate) monitoring, real-time notification, clear separation between mechanism and policy, and extensibility. To achieve these ends, Bro is divided into an `event engine' that reduces a kernel-filtered network traffic stream into a series of higher-level events, and a `policy script interpreter' that interprets event handlers written in a specialized language used to express a site's security policy. Event handlers can update state information, synthesize new events, record information to disk, and generate real-time notifications via syslog. We also discuss a number of attacks that attempt to subvert passive monitoring systems and defenses against these, and give particulars of how Bro analyzes the six applications integrated into it so far: Finger, FTP, Portmapper, Ident, Telnet and Rlogin. The system is publicly available in source code form.
---
paper_title: nProbe: an Open Source NetFlow probe for Gigabit Networks

paper_content:

Cisco NetFlow is an industry standard protocol suitable for monitoring network traffic. Although most of high-end network routers support NetFlow, very often flows are computed only on a small portion of the overall traffic due to performance limitation of NetFlow probe implementations. This paper covers the design and implementation of an open source software NetFlow probe designed for handling Gigabit traffic. As nProbe uses little CPU and memory, it has been successfully used to monitor high-speed networks at full wire speed without packet sampling in scenarios where commercial NetFlow probes could not be used due to their limitations. Finally, the paper shows how nProbe has been successfully integrated into an embedded computer named nBox.
---
paper_title: More NetFlow tools: For performance and security

paper_content:

Analysis of network traffic is becoming increasingly important, not just for determining network characteristics and anticipating requirements, but also for security analysis. Several tool sets have been developed to perform analysis of flow-level network traffic, however none have had security as the primary goal of the analysis, nor has performance been a key consideration.In this paper we present a suite of tools for network traffic collection and analysis based on Cisco NetFlow. The two primary design considerations were performance and the ability to build richer models of traffic for security analysis. Thus the data structures and code have been optimized for use on very large networks with a large number of flows. Data filter rates are approximately 80 million records in less than 1.5 minutes on a Sun 4800.
---
paper_title: Flow information storage assessment using IPFIXcol

paper_content:

Network monitoring has became a significant part of network management. Each environment and type of network have their specific, different needs. To allow network traffic monitoring in various environments, a necessity of flexible approach thus grows. The current generation of flow collectors provides only a limited flexibility, mainly due to limits of their data storage formats. Moreover, it is quite a challenging task to compare particular storage formats and their suitability for the specific environment and usage. In this paper we present IPFIXcol --- a flow collector framework designed for easy data storage formats changing. This way, we plan to evaluate performance and suitability of various data storage formats for specific tasks. Results can be used to build the most appropriate data storage for the specific production environments.
---

Title: A Survey on Network Security Monitoring Systems

Section 1: INTRODUCTION
Description 1: This section introduces the importance and complexity of network security monitoring systems and provides an overview of the paper's structure.

Section 2: NETWORK SECURITY MONITORING IMPLEMENTATIONS
Description 2: This section classifies current network security monitoring implementations into three main classes: packet capture representatives, deep packet inspection representatives, and flow-based observation representatives.

Section 3: Packet Capture Representatives
Description 3: This subsection covers tools used for packet capture analysis, including Tcpdump and Wireshark.

Section 4: Deep Packet Inspection (DPI) Representatives
Description 4: This subsection details tools that perform DPI using pattern matching, including Snort, Suricata, and Bro.

Section 5: Flow-based Observation Representatives
Description 5: This subsection describes the architecture and representatives of flow-based observation systems, differentiating between flow exporters and flow collectors.

Section 6: COMPARISON
Description 6: This section compares the described network traffic monitors based on criteria such as prototyping, developer-friendliness, and extensibility, providing a summary of findings.

Section 7: CONCLUSION
Description 7: This section concludes the paper by summarizing the different approaches to network security monitoring, their advantages, and environments where they perform best.