Security & the Enterprise
Much secured. So patch!

IP spoofing Detection with Machine Learning ?

HakobA
Explorer

With enough domain expertise in networks and network protocols, one is probably able to extract and generate useful features from the network traffic and create and tune an ML model to detect spoofing. Was wondering if anyone did any reserch in Splunk Comunity on this topic and could direct me toward any resources.

Thank You.

0 Karma

thambisetty
Super Champion

Can you share list of features you have collected?

————————————
If this helps, give a like below.
0 Karma

HakobA
Explorer

I have not collected any features. I was looking into getting some advice on how and what kind of features to extract. I know Splunk can index network traffic data.

In my opinion traffic flow information and hop count value could be valuable features to mine In the IP header... 

I just don't have enough expertise in Splunk to look for those features.

0 Karma