<abstract xmlns="http://www.w3.org/1999/xhtml">
<p>The primary focus of the study is to investigate the importance of data collection and analysis in IP networks for detecting, identifying, and responding to potential cyber attacks. It examines the use of the Suricata system’s integration with the process of sending detected anomalies to the non-relational Elasticsearch database. The research also looks into the use of Data Lakes, which are centralized storage systems capable of securely storing and analyzing massive amounts of IP traffic data in their native format. An experimental environment is presented, featuring the Elasticsearch database, REDIS cache, and Suricata IDS tool, to conduct experiments. The findings show that combining Suricata with Elasticsearch and Redis cache results a suitable combination, leading to enhanced performance and increased analysis accuracy. In conclusion, by leveraging the strengths of these technologies, it is possible to establish a robust and efficient infrastructure that effectively assists network administrators to safeguard networks against various cyber threats in the network environment.</p>
</abstract>

The primary focus of the study is to investigate the importance of data collection and analysis in IP networks for detecting, identifying, and responding to potential cyber attacks. It examines the use of the Suricata system’s integration with the process of sending detected anomalies to the non-relational Elasticsearch database. The research also looks into the use of Data Lakes, which are centralized storage systems capable of securely storing and analyzing massive amounts of IP traffic data in their native format. An experimental environment is presented, featuring the Elasticsearch database, REDIS cache, and Suricata IDS tool, to conduct experiments. The findings show that combining Suricata with Elasticsearch and Redis cache results a suitable combination, leading to enhanced performance and increased analysis accuracy. In conclusion, by leveraging the strengths of these technologies, it is possible to establish a robust and efficient infrastructure that effectively assists network administrators to safeguard networks against various cyber threats in the network environment.

An Analytical Framework for Data Collection and Analysis in IP Network

Department of Electronics and Multimedia Telecommunications, Faculty of Electrical Engineering and Informatics

Department of Computers and Informatics, Faculty of Electrical Engineering and Informatics

Acta Electrotechnica et Informatica

This work is licensed under the Creative Commons Attribution 4.0 International License.

{"article-title":"An Analytical Framework for Data Collection and Analysis in IP Network"}

The primary focus of the study is to investigate the importance of data collection and analysis in IP networks for detecting, identifying, and responding to...

An Analytical Framework for Data Collection and Analysis in IP Network

Online veröffentlicht: 02. Feb. 2024

Seitenbereich: 10 - 15

Eingereicht: 05. Juni 2023

Akzeptiert: 27. Nov. 2023

DOI: https://doi.org/10.2478/aei-2023-0012

Schlüsselwörter
Anomaly Detection, Cybersecurity, Database, Data Lakes, Machine Learning, nDPI

© 2023 Matúščavojský et al., published by Sciendo

This work is licensed under the Creative Commons Attribution 4.0 International License.

An Analytical Framework for Data Collection and Analysis in IP Network

Online veröffentlicht: 02. Feb. 2024

Seitenbereich: 10 - 15

Eingereicht: 05. Juni 2023

Akzeptiert: 27. Nov. 2023

DOI: https://doi.org/10.2478/aei-2023-0012

SchlüsselwörterAnomaly Detection, Cybersecurity, Database, Data Lakes, Machine Learning, nDPI

© 2023 Matúščavojský et al., published by Sciendo

This work is licensed under the Creative Commons Attribution 4.0 International License.

Schlüsselwörter
Anomaly Detection, Cybersecurity, Database, Data Lakes, Machine Learning, nDPI