Evaluation of Flow-Based Intrusion Detection Systems Using Network Segmentation

This research addresses the need for a comprehensive evaluation methodology to assess Flow-based IDS in segmented networks. The problem statement focuses on identifying the gaps in intrusion detection and response within segmented environments, where traditional network boundaries are no longer sufficient to protect against advanced attacks. To tackle this problem, an innovative evaluation framework is proposed that incorporates advanced threat scenarios and simulates real-world attack vectors. The main objective of this work is to develop a flow-based IDS evaluation approach that makes use of the network segmentation process to more assertively identify malicious events in the network, focusing on events present in real scenarios and mapped from the framework MITRE ATT&CK. The proposed approach has as its main characteristic the ability, using data exclusively from the flow, to perform the detection of malicious events throughout the observed network, through the analysis of its segments, with a focus directed at events originating from MITRE ATT&CK. Modern threat intelligence and leverage the MITRE ATT&CK framework are integrated to design realistic attack scenarios.