I am working on a project where I have to identify anomalies in network traffic of business networks with machine learning. The algorithm is feeded with captured network packets from inside of the business LAN. Since the business is located in Europe, constraints by the GDPR have to be considered.
I need a tool that captures, anonymizes and saves data packets with following constraints:
values should stay unique when anonymized (e.g. the same IP address should always be encrypted to the same hash value and any other IP addresses must have a different hash value). This is important so the hash can still be used as a feature for the ML model.
the process of capturing and saving the packets and the commercial use of the resulting, partially hashed data packets should comply with the GDPR guidelines. The packets are recorded on a computer whose owner has agreed. However, not everyone on the network knows that it is sniffed.
What I have tried: I have been searching for tools specifically to capture network traffic and anonymize source and destination IP and MAC adresses and found pktanon. Data captured by tcpdump can be piped to pktanon and anonymized, before it is saved. Also, the payload is completely deleted beforehand.
My Question: Do I have to consider anything else but hashing source and destination IP and MAC adresses?
Apparently it is not sufficient to anonymize IP and MAC addresses. For example, it might be possible to recalculate parts of the payload with the checksum. I'm not 100% sure if this is relevant and also I do not know which encryption algorithms meet the requirements of the GDPR.
In another thread I have found an answer which elaborates the problem. It states, that
it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data
Does this apply to my problem? Is it possible to argue that it is a legitimate interest to secure our LAN by processing personal data of all incoming data packets?
I think I'm sort of in a gray area when processing (officially) personal data. This can further be divided into packets from employees of my own company, who can be informed, and packets from outside of the LAN.
Thanks in advance!