Adaptive Methods and Tools for Shallow Packet Inspection in Anomaly Detection within Encrypted Network Traffic
A lightweight, kernel-level SPI framework implemented as a driver for the Hyper-V Extensible Switch, named RuStatExt, which aggregates network traffic into flows and extracts statistical features with negligible performance overhead is proposed, which introduces no statistically significant degradation in network throu...