Visual Support for Analyzing Network Traffic and Intrusion Detection Events using TreeMap and Graph Representations
|
|
|
- Stanley Hamilton
- 8 years ago
- Views:
Transcription
1 Visual Support for Analyzing Network Traffic and Intrusion Detection Events using TreeMap and Graph Representations Florian Mansmann 1 Fabian Fischer 1 Daniel A. Keim 1 Stephen C. North 2 1 University of Konstanz, Germany 2 AT&T Research, Florham Park, NJ, U.S.A. Symposium on Computer-Human Interaction for Management of Information Technology, Baltimore, MD, 2009
2 page 2 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Introduction Photo by Guillaume Paumier / Wikimedia Commons, CC-by-sa-3.0
3 page 3 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Introduction Do you still know, what s going on in your network? Photo by Guillaume Paumier / Wikimedia Commons, CC-by-sa-3.0
4 page 4 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 How to combine all the data? Intrusion Detection e.g. Generated IDS Events, Firewall Logs Network Traffic e.g. NetFlow connections, Bandwidth data,
5 page 5 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Visual Analytics with NFlowVis Private Network Intrusion Detection (Generated Events) Gateway Network Traffic (NetFlow) Internet PostgreSQL
6 Daily Traffic Overview
7 Daily Traffic Overview (Flows per Minute Widget)
8 Intrusion Detection View
9 Intrusion Detection View Select IDS Data Source
10 Intrusion Detection View Suspicious Hosts
11 Intrusion Detection View Suspicious Hosts
12 Home-Centric Network Visualization
13 Graph Visualization
14 Host Details View
15 NetFlow Records
16 page 16 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Service Monitoring with NFlowVis Example: Conficker Worm (11/2008) Exploits MS vulnerability RPC over Port 445/TCP Are there any compromised hosts in my network?
17 Intrusion Detection View Suspicious Hosts
18 Home-Centric Network Visualization
19 page 20 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Analyzing SSH Attacks with NFlowVis How was our network affected by these attacks?
20 Remote Hosts with SSH connections (5 th October 2009)
21 Home-Centric Network Visualization
22 Home-Centric Network Visualization (Drill-Down)
23 Home-Centric Network Visualization (Drill-Down)
24 Graph Visualization
25 Home-Centric Network Visualization (SSH Attacks on 5 th October 2009)
26 Graph Visualization (SSH Attacks on 5 th October 2009)
27 page 28 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Conclusions Intrusion Detection and Network Monitoring combined Automated Analysis combined with Interactive Exploration NFlowVis is a Visual Analytics System for Network Data
28 page 29 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Thank you very much for your attention! Questions? For further information about this work please contact Fabian Fischer Tel
29 page 30 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 References I Ball, R., Fink, G., and North, C. (2004). Home-centric visualization of network traffic for security administration. Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, pages Holten, D. (2006). Hierarchical Edge Bundles: Visualization of Adjacency Relations in Hierarchical Data. IEEE Trans. Vis. Comput. Graph., 12(5):
30 page 31 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 References II Ellson, J., Gansner, E., Koutsofios, L., North, S., and Woodhull, G. (2002). Graphviz-Open Source Graph Drawing Tools. Lecture Notes in Computer Science, pages Shneiderman, B. (1992). Tree visualization with tree-maps: 2-d space-filling approach. ACM Trans. Graph., 11(1):92 99.
31 page 32 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Hierarchical Edge Bundling
32 page 33 Visual Support for Analyzing Network Traffic Fabian Fischer CHIMIT 2009 Hierarchical Edge Bundling
Interactive Analysis of NetFlows for Misuse Detection in Large IP Networks
Interactive Analysis of NetFlows for Misuse Detection in Large IP Networks Florian Mansmann, Fabian Fischer, Daniel A. Keim, Stephan Pietzko, Marcel Waldvogel first.lastname@uni-konstanz.de Abstract: While
NStreamAware: Real-Time Visual Analytics for Data Streams to Enhance Situational Awareness
Symposium on Visualization for Cyber Security (VizSec 2014) 10th November 2014, Paris, France NStreamAware: Real-Time Visual Analytics for Data Streams to Enhance Situational Awareness Fabian Fischer and
Visualization for Network Traffic Monitoring & Security
Visualization for Network Traffic Monitoring & Security Erwan ISIT/KYUSHU, Supélec 2006 Plan Visualization Visualization Host based Network based Between networks Other prototypes Pre-processing PGVis
A Visualization Technique for Monitoring of Network Flow Data
A Visualization Technique for Monitoring of Network Flow Data Manami KIKUCHI Ochanomizu University Graduate School of Humanitics and Sciences Otsuka 2-1-1, Bunkyo-ku, Tokyo, JAPAPN manami@itolab.is.ocha.ac.jp
Simplified Network Traffic Visualization for Real-Time Security Analysis
Simplified Network Traffic Visualization for Real-Time Security Analysis Matthew Dean and Lucas Vespa Department of Computer Science University of Illinois Springfield Springfield, IL 62703 Abstract Although
Exploring Big Data using Visual Analytics
Exploring Big Data using Visual Analytics Daniel A. Keim Data Analysis and Information Visualization Group University of Konstanz, Germany Data Mining for Business Intelligence, Beer Sheva, Israel April
Visual Analytics: Towards Intelligent Interactive Internet and Security Solutions
Visual Analytics: Towards Intelligent Interactive Internet and Security Solutions James Davey 1, Florian Mansmann 2, Jörn Kohlhammer 1, and Daniel Keim 2 1 Fraunhofer IGD, Germany 2 Universität Konstanz,
Visual Analysis of Network Traffic for Resource Planning, Interactive Monitoring, and Interpretation of Security Threats
Visual Analysis of Network Traffic for Resource Planning, Interactive Monitoring, and Interpretation of Security Threats by Florian Mansmann, Daniel A. Keim, Stephen C. North, Brian Rexroad, and Daniel
A Framework for Effective Alert Visualization. SecureWorks 11 Executive Park Dr Atlanta, GA 30329 {ubanerjee, jramsey}@secureworks.
A Framework for Effective Alert Visualization Uday Banerjee Jon Ramsey SecureWorks 11 Executive Park Dr Atlanta, GA 30329 {ubanerjee, jramsey}@secureworks.com Abstract Any organization/department that
Graph Drawing for Security Visualization
Graph Drawing for Security Visualization Roberto Tamassia 1, Bernardo Palazzi 1,2,3, and Charalampos Papamanthou 1 1 Brown University, Department of Computer Science, Providence, RI, USA {rt,bernardo,cpap}@cs.brown.edu
Information Visualisation and Visual Analytics for Governance and Policy Modelling
Information Visualisation and Visual Analytics for Governance and Policy Modelling Jörn Kohlhammer 1, Tobias Ruppert 1, James Davey 1, Florian Mansmann 2, Daniel Keim 2 1 Fraunhofer IGD, Fraunhoferstr.
Security Event Management. February 7, 2007 (Revision 5)
Security Event Management February 7, 2007 (Revision 5) Table of Contents TABLE OF CONTENTS... 2 INTRODUCTION... 3 CRITICAL EVENT DETECTION... 3 LOG ANALYSIS, REPORTING AND STORAGE... 7 LOWER TOTAL COST
Visualization of Software
Visualization of Software Jack van Wijk Plenary Meeting SPIder Den Bosch, March 30, 2010 Overview Software Vis Examples Hierarchies Networks Evolution Visual Analytics Application data Visualization images
Glasnost or Tyranny? You Can Have Secure and Open Networks!
AT&T is a proud sponsor of StaySafe Online Glasnost or Tyranny? You Can Have Secure and Open Networks! Steven Hurst CISSP Director - AT&T Security Services and Technology AT&T Chief Security Office 2009
Many network and firewall administrators consider the network firewall at the network edge as their primary defense against all network woes.
RimApp RoadBLOCK goes beyond simple filtering! Many network and firewall administrators consider the network firewall at the network edge as their primary defense against all network woes. However, traditional
NVisionIP: An Interactive Network Flow Visualization Tool for Security
NVisionIP: An Interactive Network Flow Visualization Tool for Security Kiran Lakkaraju William Yurcik Ratna Bearavolu Adam J. Lee National Center for Supercomputing Applications (NCSA) University of Illinois,
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports
BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports Building a Security Operation Center Agenda: Auditing Your Network Environment Selecting Effective Security
Monitoring Network Traffic with Radial Traffic Analyzer
Monitoring Network Traffic with Radial Traffic Analyzer Daniel A. Keim Florian Mansmann Jörn Schneidewind Tobias Schreck Databases and Visualization Group University of Konstanz, Germany {keim,mansmann,schneide,schreck}@inf.uni-konstanz.de
An example. Visualization? An example. Scientific Visualization. This talk. Information Visualization & Visual Analytics. 30 items, 30 x 3 values
Information Visualization & Visual Analytics Jack van Wijk Technische Universiteit Eindhoven An example y 30 items, 30 x 3 values I-science for Astronomy, October 13-17, 2008 Lorentz center, Leiden x An
The Evolution of Information Security at Wayne State University
The Evolution of Information Security at Wayne State University Nathan W. Labadie ab0781@wayne.edu Sr. Systems Security Specialist Wayne State University A Bit of Background Covers mid-2000 to present.
Desktop Security. Overview and Technology Guidance. Michael Ramsey Network Specialist, NC DPI
Desktop Security Overview and Technology Guidance Michael Ramsey Network Specialist, NC DPI Desktop Security Best practices for both the technical type and the typical user Defensive Layering Top Vulnerabilities
CS2107 Introduction to Information and System Security (Slid. (Slide set 8)
Networks, the Internet Tool support CS2107 Introduction to Information and System Security (Slide set 8) National University of Singapore School of Computing July, 2015 CS2107 Introduction to Information
Flexible Web Visualization for Alert-Based Network Security Analytics
Flexible Web Visualization for Alert-Based Network Security Analytics Lihua Hao 1, Christopher G. Healey 1, Steve E. Hutchinson 2 1 North Carolina State University, 2 U.S. Army Research Laboratory lhao2@ncsu.edu
Network Performance Monitoring at Minimal Capex
Network Performance Monitoring at Minimal Capex Some Cisco IOS technologies you can use to create a high performance network Don Thomas Jacob Technical Marketing Engineer About ManageEngine Network Servers
An Adaptable Innovative Visualization For Multiple Levels of Users
World Applied Sciences Journal 15 (5): 722-727, 2011 ISSN 1818-4952 IDOSI Publications, 2011 An Adaptable Innovative Visualization For Multiple Levels of Users Doris Hooi-Ten Wong and Sureswaran Ramadass
INSIDER THREAT ANALYSIS USING INFORMATION-CENTRIC MODELING
Chapter 2 INSIDER THREAT ANALYSIS USING INFORMATION-CENTRIC MODELING D. Ha, S. Upadhyaya, H. Ngo, S. Pramanik, R. Chinchani and S. Mathew Abstract Capability acquisition graphs (CAGs) provide a powerful
Reference Architecture: Enterprise Security For The Cloud
Reference Architecture: Enterprise Security For The Cloud A Rackspace Whitepaper Reference Architecture: Enterprise Security for the Cloud Cover Table of Contents 1. Introduction 2 2. Network and application
Dell SonicWALL report portfolio
Dell SonicWALL report portfolio Table of contents Dell SonicWALL Global Management System (GMS ) and Analyzer reports I. Sample on-screen reports II. Sample PDF-generated reports Dell SonicWALL Scrutinizer
NetBytes Viewer: An Entity-based NetFlow Visualization Utility for Identifying Intrusive Behavior
NetBytes Viewer: An Entity-based NetFlow Visualization Utility for Identifying Intrusive Behavior Teryl Taylor, Stephen Brooks and John McHugh Abstract NetBytes Host Viewer is an interactive visualization
NSC 93-2213-E-110-045
NSC93-2213-E-110-045 2004 8 1 2005 731 94 830 Introduction 1 Nowadays the Internet has become an important part of people s daily life. People receive emails, surf the web sites, and chat with friends
VisFlowConnect-IP: A Link-Based Visualization of NetFlows for Security Monitoring
VisFlowConnect-IP: A Link-Based Visualization of NetFlows for Security Monitoring William Yurcik National Center for Supercomputing Applications (NCSA) University of Illinois at Urbana-Champaign byurcik@ncsa.uiuc.edu
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. b.zdrnja@auckland.ac.nz Abstract Honeypots are security resources which trap malicious activities, so they
Overview. Security System Administration
Better Tools for System Administration: Enhancing the Human-Computer Interface with Visualization Bill Yurcik Manager, NCSA Security Research National Center for Advanced Secure
2010 White Paper Series. Layer 7 Application Firewalls
2010 White Paper Series Layer 7 Application Firewalls Introduction The firewall, the first line of defense in many network security plans, has existed for decades. The purpose of the firewall is straightforward;
2 Technologies for Security of the 2 Internet
2 Technologies for Security of the 2 Internet 2-1 A Study on Process Model for Internet Risk Analysis NAKAO Koji, MARUYAMA Yuko, OHKOUCHI Kazuya, MATSUMOTO Fumiko, and MORIYAMA Eimatsu Security Incidents
G/On. Basic Best Practice Reference Guide Version 6. For Public Use. Make Connectivity Easy
For Public Use G/On Basic Best Practice Reference Guide Version 6 Make Connectivity Easy 2006 Giritech A/S. 1 G/On Basic Best Practices Reference Guide v.6 Table of Contents Scope...3 G/On Server Platform
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
Don t skip these expert tips for making your firewall airtight, bulletproof and fail-safe. 10 Tips to Make Sure Your Firewall is Really Secure
Don t skip these expert tips for making your firewall airtight, bulletproof and fail-safe. 10 Tips to Make Sure Your Firewall is Really Secure Security studies back up this fact: It takes less than 20
Network Monitoring On Large Networks. Yao Chuan Han (TWCERT/CC) james@cert.org.tw
Network Monitoring On Large Networks Yao Chuan Han (TWCERT/CC) james@cert.org.tw 1 Introduction Related Studies Overview SNMP-based Monitoring Tools Packet-Sniffing Monitoring Tools Flow-based Monitoring
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies
White Paper Comparison of Firewall, Intrusion Prevention and Antivirus Technologies How each protects the network Juan Pablo Pereira Technical Marketing Manager Juniper Networks, Inc. 1194 North Mathilda
End-user Security Analytics Strengthens Protection with ArcSight
Case Study for XY Bank End-user Security Analytics Strengthens Protection with ArcSight INTRODUCTION Detect and respond to advanced persistent threats (APT) in real-time with Nexthink End-user Security
Edge Configuration Series Reporting Overview
Reporting Edge Configuration Series Reporting Overview The Reporting portion of the Edge appliance provides a number of enhanced network monitoring and reporting capabilities. WAN Reporting Provides detailed
Firewall Tips & Tricks. Paul Asadoorian Network Security Engineer Brown University November 20, 2002
Firewall Tips & Tricks Paul Asadoorian Network Security Engineer Brown University November 20, 2002 Holy Firewall Batman! Your Network Evil Hackers Firewall Defense in Depth Firewalls mitigate risk Blocking
Graph Drawing for Security Visualization
Graph Drawing for Security Visualization Roberto Tamassia 1, Bernardo Palazzi 123, and Charalampos Papamanthou 1 1 Brown University, Department of Computer Science, Providence, RI, USA {rt,bernardo,cpap}@cs.brown.edu
INFORMATION VISUALIZATION TECHNIQUES USAGE MODEL
INFORMATION VISUALIZATION TECHNIQUES USAGE MODEL Akanmu Semiu A. 1 and Zulikha Jamaludin 2 1 Universiti Utara Malaysia, Malaysia, ayobami.sm@gmail.com 2 Universiti Utara Malaysia, Malaysia, zulie@uum.edu.my
Nfsight: NetFlow-based Network Awareness Tool
Nfsight: NetFlow-based Network Awareness Tool Robin Berthier Coordinated Science Laboratory Information Trust Institute University of Illinois Urbana-Champaign, IL, USA rgb@illinois.edu Michel Cukier The
Visual Analysis of Complex Firewall Configurations
Visual Analysis of Complex Firewall Configurations Florian Mansmann University of Konstanz Florian.Mansmann@unikonstanz.de Timo Göbel University of Konstanz timo.goebel@timogoebel.eu William Cheswick ches@cheswick.com
Visualizing Big Network Traffic Data using Frequent Pattern Mining and Hypergraphs
Visualizing Big Network Traffic Data using Frequent Pattern Mining and Hypergraphs Eduard Glatz Stelios Mavromatidis Bernhard Ager Xenofontas Dimitropoulos Received: 30 August 2012 / Accepted: 8 November
Sharing Intelligence is our Best Defense: Cyber Security Today Is a bit Like the Keystone Cops
Sharing Intelligence is our Best Defense: Incentives That Work versus Disincentives That Can Be Solved William Yurcik* Adam Slagell Jun Wang NCSA Security Research (NCSA) University of Illinois at Urbana-Champaign
Visualization of Host Behavior for Network Security
Visualization of Host Behavior for Network Security Florian Mansmann, Lorenz Meier, and Daniel A. Keim Abstract Monitoring host behavior in a network is one of the most essential tasks in the fields of
Information Security Attack Tree Modeling for Enhancing Student Learning
Information Security Attack Tree Modeling for Enhancing Student Learning Jidé B. Odubiyi, Computer Science Department Bowie State University, Bowie, MD and Casey W. O Brien, Network Technology Department
High Speed Data Transfer from the APS. Kenneth Sidorowicz September 27, 2006
High Speed Data Transfer from the APS Kenneth Sidorowicz September 27, 2006 Deep Inspection Firewalls Secure Computing G2 Model 4150 firewalls were installed during the September 2004 accelerator shutdown
NVisionIP and VisFlowConnect-IP: Two Tools for Visualizing NetFlows for Security
NVisionIP and VisFlowConnect-IP: Two Tools for Visualizing NetFlows for Security William Yurcik National Center for Supercomputing Applications (NCSA) University of Illinois at
Development of a Network Intrusion Detection System
Development of a Network Intrusion Detection System (I): Agent-based Design (FLC1) (ii): Detection Algorithm (FLC2) Supervisor: Dr. Korris Chung Please visit my personal homepage www.comp.polyu.edu.hk/~cskchung/fyp04-05/
Product Overview. Product Family. Product Features. Powerful intrusion detection and monitoring capacity
NIP IDS Product Overview The Network Intelligent Police (NIP) Intrusion Detection System (IDS) is a new generation of session-based intelligent network IDS developed by Huaweisymantec. Deployed in key
Network Intrusion Analysis (Hands-on)
Network Intrusion Analysis (Hands-on) TCP/IP protocol suite is the core of the Internet and it is vital to understand how it works together, its strengths and weaknesses and how it can be used to detect
Visualization of Host Behavior for Network Security
Visualization of Host Behavior for Network Security Florian Mansman, Lorenz Meier, and Daniel A. Keim Abstract Monitoring host behavior in a network is one of the most essential tasks in the fields of
Cyber Security Through Visualization
Cyber Security Through Visualization Kwan-Liu Ma Department of Computer Science University of California at Davis Email: ma@cs.ucdavis.edu Networked computers are subject to attack, misuse, and abuse.
Attack graph analysis using parallel algorithm
Attack graph analysis using parallel algorithm Dr. Jamali Mohammad (m.jamali@yahoo.com) Ashraf Vahid, MA student of computer software, Shabestar Azad University (vahid.ashraf@yahoo.com) Ashraf Vida, MA
Black Box Penetration Testing For GPEN.KM V1.0 Month dd "#$!%&'(#)*)&'+!,!-./0!.-12!1.03!0045!.567!5895!.467!:;83!-/;0!383;!
Sample Penetration Testing Report Black Box Penetration Testing For GPEN.KM V1.0 Month dd "#$%&'#)*)&'+,-./0.-121.030045.5675895.467:;83-/;0383; th, yyyy A&0#0+4*M:+:#&*#0%+C:,#0+4N:
F-SECURE MESSAGING SECURITY GATEWAY
F-SECURE MESSAGING SECURITY GATEWAY DEFAULT SETUP GUIDE This guide describes how to set up and configure the F-Secure Messaging Security Gateway appliance in a basic e-mail server environment. AN EXAMPLE
A HELPING HAND TO PROTECT YOUR REPUTATION
OVERVIEW SECURITY SOLUTIONS A HELPING HAND TO PROTECT YOUR REPUTATION CONTENTS INFORMATION SECURITY MATTERS 01 TAKE NOTE! 02 LAYERS OF PROTECTION 04 ON GUARD WITH OPTUS 05 THREE STEPS TO SECURITY PROTECTION
Security Toolsets for ISP Defense
Security Toolsets for ISP Defense Backbone Practices Authored by Timothy A Battles (AT&T IP Network Security) What s our goal? To provide protection against anomalous traffic for our network and it s customers.
Flexible Web Visualization for Alert-Based Network Security Analytics
Flexible Web Visualization for Alert-Based Network Security Analytics Lihua Hao Department of Computer Science North Carolina State University lhao2@ncsu.edu Christopher G. Healey Department of Computer
Full-Context Forensic Analysis Using the SecureVue Unified Situational Awareness Platform
Full-Context Forensic Analysis Using the SecureVue Unified Situational Awareness Platform Solution Brief Full-Context Forensic Analysis Using the SecureVue Unified Situational Awareness Platform Finding
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
Applying Penetration Tests on a Highly Secured Cooperative Network
International Arab Journal of e-technology, Vol. 1, No. 3, January 2010 65 Applying Penetration Tests on a Highly Secured Cooperative Network Qutaiba Ali, and Salah Alabady Computer Engineering Department,
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Finding Anomalies in Time- Series using Visual Correla/on for Interac/ve Root Cause Analysis
VizSec 2013 October 14, 2013 Atlanta GA, USA Finding Anomalies in Time- Series using Visual Correla/on for Interac/ve Root Cause Analysis Florian Stoffel, Fabian Fischer, Daniel A. Keim Data Analysis and
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
TOP-DOWN DATA ANALYSIS WITH TREEMAPS
TOP-DOWN DATA ANALYSIS WITH TREEMAPS Martijn Tennekes, Edwin de Jonge Statistics Netherlands (CBS), P.0.Box 4481, 6401 CZ Heerlen, The Netherlands m.tennekes@cbs.nl, e.dejonge@cbs.nl Keywords: Abstract:
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
Unit 3 Research Project. Eddie S. Jackson. Kaplan University. IT540: Management of Information Security. Kenneth L. Flick, Ph.D.
Running head: UNIT 3 RESEARCH PROJECT 1 Unit 3 Research Project Eddie S. Jackson Kaplan University IT540: Management of Information Security Kenneth L. Flick, Ph.D. 10/07/2014 UNIT 3 RESEARCH PROJECT 2
Network Instruments white paper
Network Instruments white paper USING A NETWORK ANALYZER AS A SECURITY TOOL Network Analyzers are designed to watch the network, identify issues and alert administrators of problem scenarios. These features
PeekKernelFlows: Peeking into IP flows
PeekKernelFlows: Peeking into IP flows Cynthia Wagner University of Luxembourg cynthia.wagner@uni.lu Gérard Wagener University of Luxembourg - SNT gerard.wagener@uni.lu Radu State University of Luxembourg
Outline. IT Security: General Trends and Research Directions. Technical Attacks. Typical attack. Automated attacks via Worms, Trojans, & Viruses
Outline IT Security: General Trends and Research Directions Sherif El-Kassas Department of Computer Science The American University in Cairo Practical considerations Academic and research perspective National
Conceptual Integration of Flow-based and Packet-based Network Intrusion Detection
Conceptual Integration of Flow-based and Packet-based Network Intrusion Detection Gregor Schaffrath, Burkhard Stiller Department of Informatics IFI, University of Zürich Communication Systems Group CSG
A Frequency-Based Approach to Intrusion Detection
A Frequency-Based Approach to Intrusion Detection Mian Zhou and Sheau-Dong Lang School of Electrical Engineering & Computer Science and National Center for Forensic Science, University of Central Florida,
Description: Course Details:
Course: Malicious Network Traffic Analysis Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: There are a tremendous amount of network based attacks to be aware of on the internet
Security Visualization Past, Present, Future
Security Visualization Past, Present, Future Greg Conti West Point @cyberbgone http://dl.acm.org/citation.cfm?id=2671501 http://link.springer.com/chapter/10.1007%2f978-3-540-85933-8_11 http://images.cdn.stuff.tv/sites/stuff.tv/files/styles/big-image/public/25-best-hacker-movies-ever-the-matrix.jpg?itok=kiwtknw1
8 steps to protect your Cisco router
8 steps to protect your Cisco router Daniel B. Cid daniel@underlinux.com.br Network security is a completely changing area; new devices like IDS (Intrusion Detection systems), IPS (Intrusion Prevention
CS 640 Introduction to Computer Networks. Network security (continued) Key Distribution a first step. Lecture24
Introduction to Computer Networks Lecture24 Network security (continued) Key distribution Secure Shell Overview Authentication Practical issues Firewalls Denial of Service Attacks Definition Examples Key
IC05 Introduction on Networks &Visualization Nov. 2009. <mathieu.bastian@gmail.com>
IC05 Introduction on Networks &Visualization Nov. 2009 Overview 1. Networks Introduction Networks across disciplines Properties Models 2. Visualization InfoVis Data exploration
Network Security Analysis by Using Business Intelligence
Network Security Analysis by Using Business Intelligence Wei-Yu Chen, Shing-Han Li, Mann-Jung Hsiao, Chung-Chiang Hu, and Kuo-Ching Tu Abstract Network devices including firewall, QoS, Anti-Virus wall,
McAfee Vulnerability Manager 7.0.2
McAfee Vulnerability Manager 7.0.2 The McAfee Vulnerability Manager 7.0.2 quarterly release adds features to the product without having to wait for the next major release. This technical note contains
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
The methodology. Interne. 1 Introduction
1 Introduction The methodology In an ideal world, firewall infrastructures are designed by people with experience, people who have the experience to intuitively know what they are doing. Ideally, these
FIREWALL POLICY November 2006 TNS POL - 008
FIREWALL POLICY November 2006 TNS POL - 008 Introduction Network Security Services (NSS), a department of Technology and Network Services, operates a firewall to enhance security between the Internet and
Literature Review in Visual Analytics for Malware Pattern Analysis
Literature Review in Visual Analytics for Malware Pattern Analysis M. Wagner, W. Aigner, A. Haberson, A. Rind St. Poelten University of Applied Sciences, Matthias Corvinus-Strasse 15, 3100 St. Poelten,
Large-scale coordinated attacks: Impact on the cloud security
Large-scale coordinated attacks: Impact on the cloud security Damien Riquet Gilles Grimaud M. Hauspie Team 2xS Université Lille 1, France MCNCS, Palermo, 2012 D. Riquet, G. Grimaud, M. Hauspie Large-scale
Building Secure Networks for the Industrial World
Building Secure Networks for the Industrial World Anders Felling Vice President, International Sales Westermo Group Managing Director Westermo Data Communication AB 1 Westermo What do we do? Robust data
SECURITY ADVISORY FROM PATTON ELECTRONICS
SECURITY ADVISORY FROM PATTON ELECTRONICS Potential Security Vulnerabilities Identified in Simple Network Management Protocol (SNMP) Revision 1.0 For Public Release March 7, 2002 Last Updated March 7,
3D Approach to the Visualization of Parallel Applications and Grid Monitoring Information
3D Approach to the Visualization of Parallel Applications and Grid Monitoring Information Lucas Mello Schnorr, Guillaume Huard, Philippe Olivier Alexandre Navaux Instituto de Informática Universidade Federal
Getting the Most Out of SIEM. Presentation Title. Data in Big Data. Presented By: Dr. Char Sample, CERT
Getting the Most Out of SIEM Presentation Title Data in Big Data Presented By: Dr. Char Sample, CERT Acknowledgements Dr. Ben Shniederman, UMD Big Data Big Insights George Jones, John Stogoski, CERT Alternatives
Firewalls, Tunnels, and Network Intrusion Detection. Firewalls
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
Cyberspace Forensics Readiness and Security Awareness Model
Cyberspace Forensics Readiness and Security Awareness Model Aadil Al-Mahrouqi Sameh Abdalla Tahar Kechadi Abstract The goal of reaching a high level of security in wire- less and wired communication networks
Firewalls and Intrusion Detection
Firewalls and Intrusion Detection What is a Firewall? A computer system between the internal network and the rest of the Internet A single computer or a set of computers that cooperate to perform the firewall
Workshop on Infrastructure Security and Operational Challenges of Service Provider Networks
Workshop on Infrastructure Security and Operational Challenges of Service Provider Networks Farnam Jahanian University of Michigan and Arbor Networks IFIP Working Group 10.4 June 29-30, 2006 What s the
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
WAN Optimization in MPLS Networks- the Transparency Challenge!
DATE OF ISSUE May 2005 AUTHOR Efi Gat mor 103 Eisenhower Parkway Roseland, NJ 07068 USA TEL +1.888.892.1250 +1.973.618.9000 FAX +1.973.618.9254 www.expand.com WAN Optimization in MPLS Networks- the Transparency