Network attack detection at flow level
A. A. Galtsev, Andrei M. Sukhov · 2016
Abstract. In this paper, we propose a new method for detecting unau-thorized network intrusions, based on a traffic flow model and Cisco NetFlow protocol application. The method developed allows us not only to detect the most common types of network attack (DDoS and port scanning), but also to make a list of trespassers ’ IP-addresses. There-fore, this method can be applied in intrusion detection systems, and in those systems which lock these IP-addresses.