Seyed Mohammad Mehdi Mirnajafizadeh and Ashwin Raam Sethuram, Wayne State University; David Mohaisen, University of Central Florida; DaeHun Nyang, Ewha Womans University; Rhongho Jang, Wayne State University
The collection of network data poses a significant challenge for machine/deep learning-driven network defense systems. This paper proposes a new paradigm, namely In-network Serverless Data Collection (ISDC), to eliminate the bottleneck between network infrastructure (where data is generated) and security application servers (where data is consumed). Considering the extremely mismatched scale between traffic volume and in-network resources, we stress the need for prioritizing flows based on the application's interests, and a sublinear prediction algorithm is proposed to prioritize specific flows, for optimizing resource consumption effectively. Additionally, a negotiation-free task migration mechanism with task-data isolation is introduced to allocate tasks dynamically across the network, for enhancing resource efficiency. Furthermore, ISDC incorporates a serverless data migration and aggregation mechanism to ensure data integrity and serves as a reliable and distributed data source for network defense systems. We present two use cases to demonstrate the feasibility of ISDC, namely covert channel detection and DoS/DDoS attack detection. In both scenarios, ISDC achieves significantly higher flow coverage and feature accuracy than existing schemes, leading to improved attack detection accuracy. Remarkably, ISDC's data integrity addresses a model self-poisoning issue caused by duplicated and fragmented flow measurements generated during collaborative measurements.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
![](https://www.usenix.org/sites/all/modules/usenix/usenix_files/images/usenix-locked.png)
author = {Seyed Mohammad Mehdi Mirnajafizadeh and Ashwin Raam Sethuram and David Mohaisen and DaeHun Nyang and Rhongho Jang},
title = {Enhancing Network Attack Detection with Distributed and {In-Network} Data Collection System},
booktitle = {33rd USENIX Security Symposium (USENIX Security 24)},
year = {2024},
isbn = {978-1-939133-44-1},
address = {Philadelphia, PA},
pages = {5161--5178},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/mirnajafizadeh},
publisher = {USENIX Association},
month = aug
}