0
$\begingroup$

I have a dataset of network traffic with three features that I would like to extract rules from in order to apply firewall/flow control rules i.e. the permitted flows.

I am able to classify a particular service from the network metadata and now I would like to create flow rules based on the source, destination and service of a packet. From the combination of source/destination IP and service type (of which there are 26 different types) I want to learn the rule set from the "normal" traffic flows and then any anomalous flows would then be blocked.

I have looked into OCSVM and IF as an option but get very poor results. I can only attribute this to the fact the features being used are categorical and I used encoding to use in the model. I also looked at the apriori algorithm for rule mining but from what I can see this only allows for rules to be generated between two features and in my case I need rules for three features. I am now considering looking at an autoencoder to detect anomalous flows but unsure how would work and how rules could be derived from it.

Any suggestions about other suitable approaches I can look into for this problem would be appreciated.

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.