Analysis of NetFlow Features’ Importance in Malicious Network Traffic Detection

Abstract

[EN] Malicious traffic detection allows for preventing cybersecurity-related threats. Machine learning algorithms are commonly used to detect such traffic in computer networks by analyzing packets. In wide-area networks, such as RedCAYLE (Red de Ciencia y Tecnolog´ıa de Castilla y Le´on), it is not possible to analyze every packet routed. So we pose that in such networks sampled flow data may be used to provide malicious traffic detection. This work presents the analysis carried out of the relevance that every NetFlow feature has in the K-Nearest Neighbors (KNN) algorithm in order to detect malicious traffic. Validation of the model has been carried out with real network data from RedCAYLE. Results show that it is necessary to train the models with sampled flow data. They also show that the nexthop feature has a negative influence on malicious traffic detection in wide-area networks such as RedCAYLE.