MapReduce approach to build network user profiles with top-k rankings for network security

Abstract

Network-user profiling has been used as security technique to detect unknown or malicious behaviors. Top-k rankings of reached services is a new technique for building user profiles. This technique requires to keep in memory all the traffic data during a period of time to build the rankings. However, a single user can produce gigabytes of network traffic data, which may result in low execution performance and out-of-memory errors. This work proposes a MapReduce approach that generates top-k rankings from huge network capture files.