I want to analyze a Netflow dataset by using a sliding window, therefore, I would like to know what should be taken into consideration when splitting the data? The parameter that I am considering is the window size. Any guidance/reference on how to choose this parameter would be appreciated.

  • Netflow is not a security technology. I'm not sure you have asked this in the correct place. – schroeder Oct 9 '18 at 10:17
  • How you split the data and what parameters to use is completely dependent on what you want to accomplish. – schroeder Oct 9 '18 at 10:17
  • @schroeder IDSs are designed to work by analyzing collected network traffic. I should have mentioned that my question falls in the context of security : anomaly detection. – Melinya Oct 9 '18 at 10:36
  • But your question is not about anomaly detection, it's about netflow windows. You want to use the result in an anomaly detection function, but that's tangential. – schroeder Oct 9 '18 at 10:58
  • 1
    All of those details are extremely helpful. I have done exactly what you have described. As for "appropriate", again, I am not sure how we can possibly answer that for you. It depends on the factors you want to identify and the statistical significance of the resulting windows based on your data set. It also depends on the type and nature of the flows and the focus of your anomaly definitons. I think this is more of a data science question than a security question. – schroeder Oct 9 '18 at 12:46

Browse other questions tagged or ask your own question.