The flow-reduced malware detection system by controlling inactive/active timeout

This paper shows the flow reduction effect of malware detection system through inactive/active timeout control. In the gigabyte network environment, the DB search speed of the malware detection system that processes high-speed, largecapacity data is affected by the number of stored flows. Therefore, it is necessary to reduce the number of stored flows. The malware detection system captures network data with the First-N technique and adjusts the session length by modifying the inactive/active timeout. A drill-down mechanism is used for malware inspection of network data stored in DB. Inactive/active timeout is adjusted to verify that the number of flows decreases as the session length increases.