Analysis and visualization of network traffic based on NetFlow flow export technology

Zemzerov Pavel Andreevich, Suvorov Stanislav Vadimovich

NetFlow data provides network operators with detailed information on how it is used. Using this data, you can understand who generates the most traffic, who is the object of DoS attacks, who sends spam, etc. NetFlow is also commonly used to automatically detect anomalies. The problem here is that the amount of NetFlow data collected in a typical backbone network is so large that even the best anomaly detection algorithms do not work either because of the lack of anomaly detection or because there are too many false positives. Another alternative approach to NetFlow data processing is to use visual analytics, that is, to represent large amounts of data in the form of images and animations so that people can detect anomalies during visual inspection. The main goal of this project will be to review existing methods and tools for advanced visualization of NetFlow data, as well as to offer and test a new combination of this data.

Keywords:monitoring systems, telemetry, routers, telecommunications, network security, big data