Netflow analysis: a model to detect attacks on grid computing and high speed networks

Abstract

This research project presents a proposal of study and development concerning data flow analysis in computer networks, through the use of NetFlow. The NetFlow is a recently standard adopted by the IETF (Internet Engineering Task Force, Internet Society) as IPFIX protocol (IP Flow Information Export Protocol), to export, store and to analyze data flows produced by traffic network. Thus we hope to be able to determine and to test procedures to detect denial of service, worms and prospections (scans) attacks on Internet network computer environments, mainly in grids and high speed networks. Beyond the detection of the attacks, the analysis of data will supply enough information to discover and implement countermeasures and techniques to protect networks. Through this research we intend to develop a neural network capable model to deal with information on dataflow, aiming to identify anomalies and attack on computer networks. This is a pioneer work on NetFlow application allied to artificial neural networks for security analysis and attacks detection. This project proposes to use a NetFlow flow data collection system to be installed in ANSP backbone, inside the Terremark Network Access Point (NAP) in Barueri (SP, Brazil), through the activation of the netflow resource in a Cisco router node serving the UNESP’s Institute of Theoretical Physics "SPRACE" grid computer, which is physically located in USP São Paulo University Campus, in São Paulo city. (AU)