Fig 1.
Next-generation network architecture.
Fig 2.
Flow monitoring in next-generation network architecture.
Fig 3.
Architecture of two-stage flow-based intrusion detection system.
Fig 4.
Malicious flow collection process.
Fig 5.
Training of one-class SVM using malicious flow.
Table 1.
Detailed attributes for Netflow v5 flow records.
Table 2.
Detailed flows in Sperotto’s dataset.
Table 3.
Test and training dataset—Sperotto dataset.
Table 4.
Test and training dataset—Malware and APT dataset.
Table 5.
Detail of flow records—SIP dataset.
Table 6.
Test and training dataset—SIP dataset.
Table 7.
Confusion matrix for outlier detection during one-class SVM training—Sperotto’s dataset.
Table 8.
Clustering malicious flows in second stage process—Sperotto’s dataset.
Fig 6.
SOM clustering results comparison—Sperotto’s dataset.
Table 9.
Confusion matrix for outlier detection during one-class SVM training—Malware and APT dataset.
Table 10.
SOM clustering results—Malware and APT dataset.
Fig 7.
Malware and APT clustering results comparison.
Table 11.
Confusion matrix for outlier detection during one-class SVM training—SIP dataset.
Table 12.
SOM clustering results—SIP dataset.
Fig 8.
SOM clustering results comparison—SIP dataset.