Nemea: System for network traffic analysis and anomaly detection

by do son · Published October 28, 2018 · Updated October 28, 2018

NEMEA System

NEMEA (Network Measurements Analysis) system is a stream-wise, flow-based and modular detection system for network traffic analysis. It consists of many independent modules which are interconnected via communication interfaces and each of the modules has its own task. Communication between modules is done by message passing where the messages contain flow records, alerts, some statistics or preprocessed data.

Parts of the system

The following picture shows all the important parts of the system.

Modules – basic building blocks; separate system processes; receive stream of data on their input interfaces, process it and send another stream of data to their output interfaces; all modules are simply divided into two groups according to their task:
- Detectors (red) – detect some malicious traffic, e.g. DNS tunnel, DoS, scanning
- Modules (yellow) – export&storage of flow data, preprocess or postprocess the data (filter, aggregate, merge etc.)
NEMEA Framework – set of libraries implementing features common for all modules
- TRAP (Traffic Analysis Platform) (blue) – implements communication interfaces and functions for sending/receiving the messages between interfaces
- UniRec (Unified Record) (orange) – implements efficient data format of the sent/received messages
- Common library (purple) – implements common algorithms and data structures used in modules
Supervisor (green) – central management and monitoring tool of the NEMEA system. It takes care of running modules according to a specified configuration.