MalFIX: Using IPFIX for Scaling Threat Detection to High Data Rates
Year: 2025
Type: article
Abstract: Threat intelligence feeds provide up-to-date information about threat indicators, i.e., IP addresses, hostnames, etc. This information can be used to identify potentially malicious actors by scanning network traffic. In this paper, we present a high-performance architecture for threat detection that leverages openly available threat intelligence feeds. For that purpose, the open-source tool Maltrail has been modified to make it horizontally scalable and to handle IPFIX flow data. Maltrail was adapted to process IPFIX as input and generate IPFIXcompatible output that includes information about detected threats. These threats are then ingested into Apache Kafka, enabling further analysis and integration with other tools. Benchmark results highlight the scalability of this approach, with a peak processing speed of 300,000 flows per second on 32 CPU cores.
Source: Universitätsbibliothek Tübingen
Authors: Paradzik, Gabriel, Steinert, Benjamin, Steegmüller, Janik, Menth, Michael
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W6887363138
FWCI:
Cites:
Cited by:
Related to: