Predictability of NetFlow data

The behaviour of individual devices connected to an enterprise network can vary dramatically, as a device’s activity depends on the user operating the device as well as on all behind the scenes operations between the device and the network. Being able to understand and predict a device’s behaviour in a network can work as the foundation of an anomaly detection framework, as devices may show abnormal activity as part of a cyber attack. The aim of this work is the construction of a predictive regression model for a device’s behaviour at normal state. The behaviour of a device is presented by a quantitative response and modelled to depend on historic data recorded by NetFlow.