Abstract

In today’s increasingly complicated network environments, effective cybersecurity analytics necessitate scalable data processing systems that can handle massive amounts of diverse traffic data. This article compares relational, graph-based, and streaming data systems for cybersecurity analytics using the CICIDS2017 dataset. We specifically compare a columnar cloud data warehouse (Amazon Redshift) with a graph database (Neo4j) using example analytical queries to investigate trade-offs in query expressiveness, performance, and data modeling flexibility. In addition, we evaluate a real-time data intake pipeline built on Apache Kafka and Apache Cassandra to investigate ingestion throughput and low-latency storage features under simulated streaming workloads. The systems are examined independently to highlight their strengths and weaknesses in batch analytics, relationship-centric analysis, and real-time monitoring. The findings offer practical insights into how alternative data models and processing paradigms impact cybersecurity analytical tasks, as well as recommendations for selecting optimal data systems for network traffic analytics and intrusion detection use cases.

IPC Classification

Keywords