Security & the Enterprise
Much secured. So patch!

IP spoofing Detection with Machine Learning ?


With enough domain expertise in networks and network protocols, one is probably able to extract and generate useful features from the network traffic and create and tune an ML model to detect spoofing. Was wondering if anyone did any reserch in Splunk Comunity on this topic and could direct me toward any resources.

Thank You.

0 Karma

Super Champion

Can you share list of features you have collected?

If this helps, give a like below.
0 Karma


I have not collected any features. I was looking into getting some advice on how and what kind of features to extract. I know Splunk can index network traffic data.

In my opinion traffic flow information and hop count value could be valuable features to mine In the IP header... 

I just don't have enough expertise in Splunk to look for those features.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...