PCAPLib: A System of Extracting, Classifying, and Anonymizing Real Packet Traces

Abstract

This paper presents the PCAPLib system for providing extracted, well-classified, and anonymized packet traces from real network traffic with two mechanisms. First, active trace collection actively extracts and classifies packet traces into sessions by leveraging multiple detection devices. Second, deep packet anonymization protects the privacy in the packet payloads for hundreds of application protocols while preserving the utility of the traces. We evaluate 318 anonymized packet traces collected over a period of four months and show that the efficiency of anonymization is up to 96%. The usefulness of this system for assessing false positives/false negatives in intrusion detection has been also demonstrated.