Emulation Environment for Ground Truth Establishment
Carlos Miguel dos Santos Miranda, Paulo Salvador, António Nogueira, Eduardo Rocha, Rui Valadas · 2010
Network security is a hot topic to network users and managers, whether they are institutional, enterprise or domestic. New threats or mutations of existing ones appear at a very fast rate and the solutions that are nowadays used to fight them frequently require a real-time analysis of the network traffic or a previous training based on real data. Most of the times, this training must be supervised by humans that, depending on their experience, can create security breaches in the system without knowing it. Since existing anomaly detection methodologies have to be trained and tested in order to validate their efficiency, there is an increasing need for trustworthy network traffic data that can be used without compromising users confidentiality, obeys to some pre-established criteria and is completely known in terms of its underlying protocols. In fact, the effectiveness of network anomaly detectors cannot be fully evaluated without having a complete control of the entire evaluation experiment, which requires that it should be possible to change the location, magnitude and type of individual anomalies and background traffic. In this work, we propose an emulation environment that can be used to obtain trustworthy network data both in the presence of licit and illicit applications. We also present some topological and traffic scenarios that were already defined to start gathering network data and make it immediately available to the scientific community. The emulation environment was built in an evolutionary way, enabling the easy introduction of new network scenarios and services and/or the refinement of the existing ones. Keywords-Ground truth, emulation, licit and illicit applications.