MSNM Sensor – Multivariate Statistical Network Monitoring Sensor

MSNM Sensor (Multivariate Statistical Network Monitoring-Sensor) shows the practical suitability of the approaches found in PCA-MSNM and in Hierarchical PCA-MSNM works.

The first one present the MSNM approach and new multivariate statistical methodology for network anomaly detection while the second one proposes the previous one in a hierarchical and structured network systems.

The main idea behind these works, is the use of multivariate statistical techniques to generate useful information in the form of two statistics. Such a light information comes from lower to higher levels in a network hierarchy.

Also Read – Python Uncompyle6 – A Cross-Version Python Bytecode Decompiler

This way, the root sensor (for example, a border router) received all the statistical information being able to compute its own statistics (Q,D). By inspecting this statistics, a security analyst can determine if anomalous event are happening when some of the statistic values are above certain control limits.

MSNM-S is conceived to be extremely scalable and aseptic because just two parameters are sent among levels or devices in the monitored network or system. Additionally, the MSNMSensor is able to manage multiple and heterogeneous type data sources at each monitored devices thanks to the FCParser (Feature as a Counter Parser) feature engineering approach.

Installation

Requirements

MSNSensor runs with python 2.7 and has been successfully tested on Ubuntu from 16.04 version and above. Also, the following dependencies has to be installed.

How to install

Creating a python execution environment is, probably the better way to run the application. So I recommend you to create one before doing the requirements installation. Anaconda environment can help you and, if you decide to use it, run the following commands:

$ conda create -n py27 python=2.7
$ conda activate py27

Running the previous command will install everything needed.

(py27) $ pip install -r requirements.txt

How to run an example

Please see instructions at examples or download the pre-configured VM at MSNM-S-UBUNTU. We recommend you to use the VM. Remember to pull the repository to get the MSNM-S project updated. In the following, you can see the necessary steps to run the pre-configure experiment in the VM:

Running the MSNM-Ss (backend)

Open a terminal window and activate netflow daemon and collector.

$ cd ~/msnm-sensor/scripts/netflow/
$ sudo ./activateNetflow.sh (pass: msnm1234)

Wait for 5 minutes to get netflow records. Run and deploy the MSNM-Ss in example/scenario_4 example:

$ cd ~/msnm-sensor/scripts/ $ conda activate py27
$ ./start_experiment.sh ../examples/scenario_4/
$ ps -ef | grep msnmsensor (just to check if all the four MSNM-Ss are running)
$ tail -500f ~/msnm-sensor/examples/scenario_4/borderRouter/logs/msnm.log (another way to see how the MSNM-S is working. Replace the name of the MSNM-S if you want to see the others.)

Running the dashboard (frontend):

Open a new terminal window.

$ cd ~/msnm-sensor/dashboard/
$ conda activate msnm-dashboard
$ ln -s ../examples examples
$ python manage.py runserver

Browse to http://localhost:8000

R K

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

7 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

7 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

7 days ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

7 days ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

1 week ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

1 week ago