The aim is to create a system that achieves higher threat detection rate and better quality of data acquisition in networks. That will be accomplished using feedback loop from detection systems to probes. Detection systems will, based on data analysis, request probes to perform more detailed analysis of a selected traffic portion. Probes will carry out additional processing, eg. application layer processing or full packet capture. New probe for 400 Gbps processing will be created in the project.
January 2017 - December 2020
VI20172020064
Results
- Flowmon exporter module for packet capture
- Modules to control level of detail based on threat detection
- Software for control and collection of IDS events on monitoring probes
- System for Adaptive Control of Data Collection and Analysis in High Speed Networks
