Infrastructure for Generating New IDS Dataset

Abstract

This article describes the proposal of a system that was designed for effective network monitoring, analysis of network infiltration, and archiving of network flows for their later research. The article contains the design of an appropriate infrastructure for such a system under the conditions of the Department of Information Networks. The objective was to develop a methodology for creating a custom dataset that would contain normal network traffic and traffic with various types of attacks. Dataset can be used to test network attack detection methods that the research team is working on at the Department of Information Networks. We started with detailed analysis of the available datasets, which is an important source of information for creating a custom dataset, and to identify the imperfections of these datasets, and requirements, that a trusted dataset should meet. The article describes the course of implementation, testing and optimization of one of the possible solutions of such a system. The final part of the article informs about designing the appropriate infrastructure, and using the system for dataset creation. Articel describes also tools which were used to perform DoS, DDoS attacks and botnet architecture. The article follows the work presented in [1].