Parallel Processing in Netflow Data Fusion - Cert

More documents

Recommendations

Info

Use Case: Social NetworkGrowth• Social Networks for Computers and Networks• Given an IP address or addresses, ornetwork range characterize relationshipsbetween those and other computers ornetworks• Scenario:• An IDS alert provides some indication that agiven host is compromised• We may want to know who this machinetalks to• Whether the machine’s “friends list” (othersystems) is growing rapidly
Use Case: Data ExfiltrationDiscovery• Social Network prioritization based on bytestransferred• Scenario:• An IDS alert provides some indication that agiven host is compromised.• Cross reference attacker’s IP with the GeoIPand other reputation databases.• Construct the social network of othersystems this IP communicates with.• Sort by bytes transferred – the top systemsin this list may be candidates for dataexfiltration nodes.
Page 1 and 2: Parallel Processing in NetflowData
Page 3 and 4: Agenda cont’d• Specific use cas
Page 6 and 7: Setting the Stage Cont…• Goals
Page 10 and 11: Use Case: SPAM Node and C2Discovery
Page 12 and 13: Use Case: Complex Fusion• Mixing

Parallel Processing in Netflow Data Fusion - Cert

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?