Flow Visualization Using MS-Excel - Cert

More documents

Recommendations

Info

Data Preparation Steps•Data Pull• Data Reduction• Importing Data• Data Formatting• Sample analysis slides
Data PullAnalysts have several options when trying to pullinteresting datasets. Several methods we finduseful are:• Collecting data during non-business hours– Reduces traffic from users; helps expose automated sessions• Search for outbound traffic only– Reduces noise from scanning, etc.• Filtering for packets with the PSH/ACK flags set in the initial flags field– Focuses the traffic on sessions where data is actually transferred• Filtering for packets with the SYN flag set in the initial flags field– Focuses on sessions initiated by your organization• Limit traffic to records under 5K bytes– Most cyclical sessions (beaconing) happen in this rangeTraffic should be refined to provide the best possible dataset for analysts towork with.
Page 1 and 2: Flow Visualization Using MS-ExcelVi
Page 3: Pro’s and Con’s• Pro’s:- Vi
Page 7 and 8: Importing DataData is imported from
Page 9 and 10: Data Formatting Cont.US-CERT analys
Page 11 and 12: PlotCreating charts from theselecte
Page 13 and 14: HighlightBy hovering over a data po
Page 16 and 17: Byte Based Patterns
Page 18 and 19: sPort vs. dPort
Page 20 and 21: Comprehensive View
Page 22 and 23: Multi-day ViewWorkday Week endWorkd
Page 24 and 25: Additional AnalysisDetermining appl
Page 26 and 27: Structured Gateway
Page 28 and 29: Gateway Mannerisms
Page 30 and 31: Split View
Page 32 and 33: Application ColoringGreen = HTTP, B
Page 34 and 35: Colorization Example - GW2IP
Page 36: Questions?

Flow Visualization Using MS-Excel - Cert

Create successful ePaper yourself

Delete template?

Save as template?