Utilising Flow Aggregation to Classify Benign Imitating Attacks

Cyber-attacks continue to grow, both in terms of volume and sophistication. This is aided by an increase available computational power, expanding attack surfaces, advancements the human understanding how make attacks undetectable. Unsurprisingly, machine learning utilised defend against these attacks. In many applications, choice features more important than model. A range studies have, with varying degrees success, attempted discriminate between benign traffic well-known cyber-attacks. The used are broadly similar have demonstrated their effectiveness situations where cyber-attacks do not imitate behaviour. To overcome this barrier, manuscript, we introduce new based on a higher level abstraction network traffic. Specifically, perform flow aggregation grouping flows similarities. additional feature benefits from cumulative information, thus qualifying models classify that mimic performance evaluated using benchmark CICIDS2017 dataset, results demonstrate validity effectiveness. novel proposal will improve detection accuracy also build towards direction extraction for complex ones.