We have flow_stats and removed_flow_stats that show the distribution of removed and table flows' IP source, IP destination and protocol. These stats can help in finding out the malicious hosts.
After mitigation history batches store the mitigation phase stats which deviates from the general traffic and it also disturbs the data. We need to find a way to inhibit this.
We can use ML for detection and also for mitigation. Our current data is suitable for detection but not help to label flows as suspected or whitelist. We can discuss more about this.
We have many parameters now, residing in the parameters.py. We need to optimize parameters by testing.
Attack and benign traffic can simultaneously work, which can be achieved by threading.
We need to get a larger data to test our algorithm, further benign cases will be written
We need to plot the data for both poster and report.
flow_stats
andremoved_flow_stats
that show the distribution of removed and table flows' IP source, IP destination and protocol. These stats can help in finding out the malicious hosts.