I have a dataset of network traffic with three features that I would like to extract rules from in order to apply firewall/flow control rules i.e. the permitted flows.

I am able to classify a particular service from the network metadata and now I would like to create flow rules based on the source, destination and service of a packet. From the combination of source/destination IP and service type (of which there are 26 different types) I want to learn the rule set from the "normal" traffic flows and then any anomalous flows would then be blocked.

I have looked into OCSVM and IF as an option but get very poor results. I can only attribute this to the fact the features being used are categorical and I used encoding to use in the model. I also looked at the apriori algorithm for rule mining but from what I can see this only allows for rules to be generated between two features and in my case I need rules for three features. I am now considering looking at an autoencoder to detect anomalous flows but unsure how would work and how rules could be derived from it.

Any suggestions about other suitable approaches I can look into for this problem would be appreciated.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.