IP spoofing Detection with Machine Learning ?

[HakobA]

With enough domain expertise in networks and network protocols, one is probably able to extract and generate useful features from the network traffic and create and tune an ML model to detect spoofing. Was wondering if anyone did any reserch in Splunk Comunity on this topic and could direct me toward any resources.

Thank You.

[thambisetty]

Can you share list of features you have collected?

[HakobA]

I have not collected any features. I was looking into getting some advice on how and what kind of features to extract. I know Splunk can index network traffic data.

In my opinion traffic flow information and hop count value could be valuable features to mine In the IP header... 

I just don't have enough expertise in Splunk to look for those features.