An Analytical Framework for Data Collection and Analysis in IP Network

Abstract

The primary focus of the study is to investigate the importance of data collection and analysis in IP networks for detecting, identifying, and responding to potential cyber attacks. It examines the use of the Suricata system’s integration with the process of sending detected anomalies to the non-relational Elasticsearch database. The research also looks into the use of Data Lakes, which are centralized storage systems capable of securely storing and analyzing massive amounts of IP traffic data in their native format. An experimental environment is presented, featuring the Elasticsearch database, REDIS cache, and Suricata IDS tool, to conduct experiments. The findings show that combining Suricata with Elasticsearch and Redis cache results a suitable combination, leading to enhanced performance and increased analysis accuracy. In conclusion, by leveraging the strengths of these technologies, it is possible to establish a robust and efficient infrastructure that effectively assists network administrators to safeguard networks against various cyber threats in the network environment.

Keywords

• anomaly detection
• cybersecurity
• database
• data lakes
• machine learning
• ndpi