1

I've written some anomaly detection program that recognize abnormal traffic on system, but it sometimes detect normal download or upload traffic as abnormal. Is there any way to check if a download or upload now is in process or not to reduce this false positive?

5
  • 1
    askubuntu.com/questions/257263/… try this might help
    – Premkumar
    Oct 15, 2014 at 6:20
  • Can you show us some of how you have approached it?
    – Pogrindis
    Oct 15, 2014 at 7:23
  • @Pogrindis :I've used knn algorithm for data that contain 3 parameters: cpu, (network traffic)transmitted bytes and receieved bytes
    – Mjina
    Oct 15, 2014 at 8:00
  • @Mjina and what is your definition of abnormal traffic? could you identify the procID runtime of the download / upload process ?
    – Pogrindis
    Oct 15, 2014 at 8:03
  • @Pogrindis:I use knn as a machine learning method, so it will be trained with normal data and abnormal data, and then is expected to detect abnormal, the problem is that download and upload sometimes are so fast that resemble an attack like DoS which rise the traffic rates. your second question is just what I'm looking for, how to identify the process which is downloading/uploading?!
    – Mjina
    Oct 15, 2014 at 8:11

1 Answer 1

2

The best answer i can think of and it will require some input from you in order to work with the data is nethogs!

Install nethogs (should be in repo)

And it will work like this :

nethogs
nethogs eth1
nethogs [option] eth0 eth1
nethogs [option] eth0 eth1 ppp0
sudo /usr/sbin/nethogs eth0

You will end up with something like this :

Nethogs output

With this you will be able to identify the procID which is using the most upload and download..

You can also identify all of the nics and see them listed as one with identifying network controller : enter image description here

The next step is where im not sure... You might need to create some parser of the info, setup a cron and feed it into your abnormal trafic analyzer.

Sorry its not a complete solution but its the only idea I have right now!

1
  • is it possible to run it remotely on a system? I've didn't find this possibility in it's man page.
    – Mjina
    Oct 20, 2014 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .