E. Pennucci, A. Repola - Go with the (net)flow: a tale of fixing ML-based network ...
Examines E. Pennucci, A. Repola - Go with the (net)flow: a tale of fixing ML-based network and evaluates key implications for security practitioners.
Summary
ML for network intrusion detection
Hermes Pennucci and Antonio Repola from Inexa Defense review machine-learning-based network intrusion detection, covering popular tools, bugs they found, and their open-source NetFlowMeter feature extractor. Neural approaches excel at pattern recognition but depend on reliable flow statistics.
Why CICFlowMeter failed at scale
While automating large PCAP pipelines, sub-gigabyte files triggered JVM out-of-memory errors even on upgraded hardware. Source review showed an unmaintainable C/Java mix with poor documentation, prompting a full rewrite rather than incremental patching.
NetFlowMeter improvements
Their replacement addresses TCP reset-flag handling bugs where a flow starting with RST was allocated but never terminated, causing resource leaks when combined with flow cutting. They also experiment with removing idle-timeout features that most public datasets assume at default values, showing early promise for cleaner ML training data.
Related talks
No Hat 2025·30 min
Maria Khodak
Details maria Khodak - Poison in the Wires: Interactive Network Visualization of Data and evaluates key implications for security practitioners.
BSidesAugusta·55 min
Flow Data
Engineers explore architecture and security mechanisms for Jason Smith - Network Situational Awareness with Flow Data.
Videos·50 min
Elias ISSA
Engineers explore architecture and security mechanisms for 🇫🇷 The Red and the Blue: a tale of stealth and detection - Elias ISSA - shadow_gatt.