Positional Packet Capture for Anomaly Detection in Multitenant Virtual Networks

Abstract

Anomaly detection in multitenant virtual networks presents significant challenges due to the dynamic, ephemeral nature of virtualized environments and the complex traffic patterns they generate. This paper presents a definition of preferable positions within virtual networks to enhance anomaly detection efficacy. Leveraging a combination of overlay and underlay capture positions, this paper examines the strategic impact of network positioning on anomaly detection accuracy, particularly in environments utilizing software-defined networking (SDN) and network function virtualization (NFV). Through controlled testing with realistic attack scenarios, including data exfiltration, denial of service, and malware infiltration, the advantages and constraints of each capture position are demonstrated. The findings underscore the necessity of adaptable capture mechanisms to address variability in data volume, encapsulation challenges, and privacy concerns unique to virtualized ecosystems. The paper further introduces a cost calculation model that evaluates each capture position by weighting key factors, enabling an optimized trade-off between detection accuracy and resource efficiency. The derived classification of the positional value significantly improves real-time detection of both internal and external threats within multitenant networks.