Network anomaly detection for cybersecurity

Abstract

In the context of using computers with single or multiple network interfaces as networking devices, and the deployment of BPF as an in-kernel programmable virtual computer, this master's thesis focuses on the development of a network anomaly detection tool using BPF for traffic monitoring. More specifically, it examines the various methods of traffic monitoring on networking devices with BPF and evaluates the performance of these methods through experimentation on actual devices. Based on the results of these experiments, an architecture of a network intrusion detection tool is then proposed.