A flexible Python framework for fast network flow data analysis, offering encrypted application identification, statistical feature extraction, and extensibility via plugins.
NFStream is a Python framework for network flow data analysis that processes both online and offline network traffic. It provides fast, flexible data structures for aggregating packets into flows, extracting statistical features, and identifying encrypted applications using deep packet inspection. The framework solves the problem of inconsistent and non-reproducible network data analysis by offering a unified, extensible platform for researchers and practitioners.
Network researchers, data scientists, and security analysts who need to analyze network traffic flows, extract features for machine learning, or perform encrypted application identification. It is also suitable for developers building network monitoring or traffic management tools.
Developers choose NFStream for its high performance, built-in encrypted traffic visibility via nDPI, and extensibility through plugins. Its focus on reproducibility and machine learning integration makes it a preferred choice for research and practical deployments where consistent feature extraction and model deployment are critical.
NFStream: a Flexible Network Data Analysis Framework.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Leverages AF_PACKET_V3/FANOUT on Linux, multiprocessing, and a CFFI engine for fast packet processing, as emphasized in the README for handling online traffic efficiently.
Integrates nDPI for reliable identification of encrypted applications like TLS and SSH, extracting metadata such as server names and fingerprints without decryption.
NFPlugins allow custom flow feature creation in a few lines of Python, enabling easy adaptation for specific analysis needs, demonstrated in the README with examples.
Designed for reproducible ML model training and deployment on live networks, with a common feature computation logic that ensures consistency across experiments.
Requires separate Npcap driver installation on Windows due to license restrictions, adding complexity and potential compatibility issues, as noted in the README.
Encrypted application identification is limited to what nDPI supports; proprietary or emerging protocols may not be covered, restricting visibility in some environments.
While extensible, creating effective NFPlugins requires deeper understanding of flow processing internals, which can be challenging for users new to network data analysis.