Network Anomaly Detection Using NetFlow and Network Automation

NetFlow is a Cisco proprietary protocol that can be useful other than network monitoring. It is available as an embedded system in most Cisco routers and switches. This protocol provides the ability to collect ingress and egress network traffic statistics that can be useful for detection of network anomaly and subsequent defense. It allows detection of unusual and suspicious network traffic conditions which can be characterized based on its communication behavior. Network automation such as ansible was used to automate the collection of the network traffic using NetFlow. Network anomaly was detected by comparing the baseline normal network operation from abnormal network operation.