Intruder Alert!: Visual Analysis of Network Intrusion Data. CS 533C Course Project Dustin Lang March 19, 2003
|
|
|
- Allan Allen
- 5 years ago
- Views:
Transcription
1 Intruder Alert!: Visual Analysis of Network Intrusion Data CS 533C Course Project Dustin Lang March 19, 2003
2 The Basic Idea In a security-conscious environment, when a computer is compromised ( cracked ), the security team must quickly determine what weakness was exploited, how, and by whom.
3 The Basic Idea In a security-conscious environment, when a computer is compromised ( cracked ), the security team must quickly determine what weakness was exploited, how, and by whom. The data: packet logs, such as generated by tcpdump. One line of information about each packet traversing the network.
4 The problem: lots of data in cryptic form. Most of the packets are friendlies. The user needs to find and characterise a small number of attack packets.
5 The problem: lots of data in cryptic form. Most of the packets are friendlies. The user needs to find and characterise a small number of attack packets. The idea: develop graphical representations that allow anomalous packets and patterns to be discovered visually.
6 In A Little More Detail... The Data Data sets come from the Information Exploration Shootout contest. Four different attack data sets plus a baseline data set.
7 The Data time,src_addr,src_port,dest_addr,dest_port,flag,seq1,seq2,ack,win,buf,ulen,op ,1,110,2,4051,., , , ,4096,512,,"" ,1,110,2,4051,.,512,1024,1,4096,512,,"" ,3,2210,2,1193,P, , , ,7700,35,,"" ,2,3209,4,80,.,,, ,16384,,,"" ,2,4051,1,110,.,,,1024,4096,,,"" ,2,3164,5,20,.,,, ,16384,,,"" ,2,3086,6,80,.,,, ,8704,,,"" ,2,4580,7,1035,.,,, ,11216,,,"" ,2,4979,8,23,.,,, ,16384,,,"" ,3,2210,2,3765,P, , , ,8111,35,,"" ,3,2210,2,3529,P, , , ,7864,35,,"" ,3,2210,2,3580,P, , , ,7700,35,,"" ,9,3860,2,2666,., , , ,61440,512,," [tos 0x10]"
8 13 fields per packet. The Data
9 The Data 13 fields per packet. 500, 000 packets per dataset.
10 The Data 13 fields per packet. 500, 000 packets per dataset. Packets can be thought of as discrete events in time.
11 The Data 13 fields per packet. 500, 000 packets per dataset. Packets can be thought of as discrete events in time. Packets have sources and destinations, but there is no intrinsic spatial arrangement.
12 Is this a tool for realtime monitoring? No. There are already systems for automatically monitoring networks for known types of attacks (Network Intrusion Detection Systems, NIDS).
13 Is this a tool for realtime monitoring? No. There are already systems for automatically monitoring networks for known types of attacks (Network Intrusion Detection Systems, NIDS). Human intervention is required to determine the attack signature of new attacks. Once the attack signature is discovered, it can be added to the NIDS to protect the network from attacks of this type in the future.
14 Solutions for too much data We don t want to show 500,000 data items at once, so need strategies for reducing the volume of data: Aggregation - collect similar packets and treat them as a single unit. For example, group together all packets belonging to a single session (one TCP connection, for example).
15 Solutions for too much data We don t want to show 500,000 data items at once, so need strategies for reducing the volume of data: Aggregation - collect similar packets and treat them as a single unit. For example, group together all packets belonging to a single session (one TCP connection, for example). Statistics on groups of packets.
16 Solutions for too much data We don t want to show 500,000 data items at once, so need strategies for reducing the volume of data: Aggregation - collect similar packets and treat them as a single unit. For example, group together all packets belonging to a single session (one TCP connection, for example). Statistics on groups of packets.
17 Filtering of packets interactively.
18 Filtering of packets interactively. Zoomability, with different levels of detail depending on zoom.
19 Progress Use a real database (MySQL) as a backend; this provides convenient persistent storage, access speed, and an advanced query language.
20 Progress Use a real database (MySQL) as a backend; this provides convenient persistent storage, access speed, and an advanced query language. Frontend in Java, probably using the Zoomable Visual Transformation Machine (ZVTM) graphical toolkit. ( )
21 Progress Use a real database (MySQL) as a backend; this provides convenient persistent storage, access speed, and an advanced query language. Frontend in Java, probably using the Zoomable Visual Transformation Machine (ZVTM) graphical toolkit. ( )
22 I have been focussing on the backend parts; no pretty pictures there!
23 I have been focussing on the backend parts; no pretty pictures there! It s important to avoid trying to query and plot 500,000 data items at once; I ve been developing strategies for doing incremental searches, and gathering statistics rather than raw data when the volume of data is too large.
24
25 Thanks! Fin
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 19: Intrusion Detection Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline Intruders Intrusion detection host-based network-based
CS419 Spring Computer Security. Vinod Ganapathy Lecture 13. Chapter 6: Intrusion Detection
CS419 Spring 2010 Computer Security Vinod Ganapathy Lecture 13 Chapter 6: Intrusion Detection Security Intrusion & Detection Security Intrusion a security event, or combination of multiple security events,
Network Intrusion Analysis (Hands on)
Network Intrusion Analysis (Hands on) TCP/IP protocol suite is the core of the Internet and it is vital to understand how it works together, its strengths and weaknesses and how it can be used to detect
Overview Intrusion Detection Systems and Practices
Overview Intrusion Detection Systems and Practices Chapter 13 Lecturer: Pei-yih Ting Intrusion Detection Concepts Dealing with Intruders Detecting Intruders Principles of Intrusions and IDS The IDS Taxonomy
CNIT 121: Computer Forensics. 9 Network Evidence
CNIT 121: Computer Forensics 9 Network Evidence The Case for Network Monitoring Types of Network Monitoring Types of Network Monitoring Event-based alerts Snort, Suricata, SourceFire, RSA NetWitness Require
Connection Logging. Introduction to Connection Logging
The following topics describe how to configure the Firepower System to log connections made by hosts on your monitored network: Introduction to, page 1 Strategies, page 2 Logging Decryptable Connections
Connection Logging. About Connection Logging
The following topics describe how to configure the Firepower System to log connections made by hosts on your monitored network: About, page 1 Strategies, page 2 Logging Decryptable Connections with SSL
Incorporating Network Flows in Intrusion Incident Handling and Analysis
Regional Visualization and Analytics Center Incorporating Network Flows in Intrusion Incident Handling and Analysis John Gerth Stanford University gerth@stanford.edu FloCon 2008 1 EE/CS Network Infrastructure
Network Intrusion Detection Systems. Beyond packet filtering
Network Intrusion Detection Systems Beyond packet filtering Goal of NIDS Detect attacks as they happen: Real-time monitoring of networks Provide information about attacks that have succeeded: Forensic
You will discuss topics related to ethical hacking, information risks, and security techniques which hackers will seek to circumvent.
IDPS Effectiveness and Primary Takeaways You will discuss topics related to ethical hacking, information risks, and security techniques which hackers will seek to circumvent. IDPS Effectiveness and Primary
Intrusion Detection. Comp Sci 3600 Security. Introduction. Analysis. Host-based. Network-based. Distributed or hybrid. ID data standards.
or Detection Comp Sci 3600 Security Outline or 1 2 3 4 5 or 6 7 8 Classes of or Individuals or members of an organized crime group with a goal of financial reward Their activities may include: Identity
Improving the Database Logging Performance of the Snort Network Intrusion Detection Sensor
-0- Improving the Database Logging Performance of the Snort Network Intrusion Detection Sensor Lambert Schaelicke, Matthew R. Geiger, Curt J. Freeland Department of Computer Science and Engineering University
n Explain penetration testing concepts n Explain vulnerability scanning concepts n Reconnaissance is the first step of performing a pen test
Chapter Objectives n Explain penetration testing concepts n Explain vulnerability scanning concepts Chapter #4: Threats, Attacks, and Vulnerabilities Vulnerability Scanning and Penetration Testing 2 Penetration
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Intrusion Detection Systems Intrusion Actions aimed at compromising the security of the target (confidentiality, integrity, availability of computing/networking
ICS Security Monitoring
ICS Security Monitoring INFRASTRUCTURE MINING & METALS NUCLEAR, SECURITY & ENVIRONMENTAL OIL, GAS & CHEMICALS Moses Schwartz Security Engineer Computer Incident Response Team Bechtel Corporation State
Means for Intrusion Detection. Intrusion Detection. INFO404 - Lecture 13. Content
Intrusion Detection INFO404 - Lecture 13 21.04.2009 nfoukia@infoscience.otago.ac.nz Content Definition Network vs. Host IDS Misuse vs. Behavior Based IDS Means for Intrusion Detection Definitions (1) Intrusion:
Configuring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
Stager. A Web Based Application for Presenting Network Statistics. Arne Øslebø
Stager A Web Based Application for Presenting Network Statistics Arne Øslebø Keywords: Network monitoring, web application, NetFlow, network statistics Abstract Stager is a web based
Computer Forensics: Investigating Network Intrusions and Cybercrime, 2nd Edition. Chapter 2 Investigating Network Traffic
Computer Forensics: Investigating Network Intrusions and Cybercrime, 2nd Edition Chapter 2 Investigating Network Traffic Objectives After completing this chapter, you should be able to: Understand network
Needle in a Haystack. Improving Intrusion Detection Performance in University settings by removing good traffic to better focus on bad traffic
Needle in a Haystack Improving Intrusion Detection Performance in University settings by removing good traffic to better focus on bad traffic The Person Talking Paul Tatarsky paul@tatarsky.com Network
The Future of Threat Prevention
The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network
icast / TRUST Collaboration Year 2 - Kickoff Meeting
icast / TRUST Collaboration Year 2 - Kickoff Meeting Robin Sommer International Computer Science Institute robin@icsi.berkeley.edu http://www.icir.org Projects Overview Project 1 NIDS Evasion Testing in
Packets Don t Lie: What s Really Happening on Your Network?
Packets Don t Lie: What s Really Happening on Your Network? Sponsored by LogRhythm Today s Speakers Dave Shackleford SANS Analyst and Instructor Rob McGovern LogRhythm Senior Technical Product Manager
Configuring Dashboards
CHAPTER 2 This chapter describes dashboards, and how to add and delete them. It contains the following topics: Understanding Dashboards, page 2-1 Adding and Deleting Dashboards, page 2-1 Understanding
ACS / Computer Security And Privacy. Fall 2018 Mid-Term Review
ACS-3921-001/4921-001 Computer Security And Privacy Fall 2018 Mid-Term Review ACS-3921/4921-001 Slides Used In The Course A note on the use of these slides: These slides has been adopted and/or modified
CYBER ANALYTICS. Architecture Overview. Technical Brief. May 2016 novetta.com 2016, Novetta
CYBER ANALYTICS Architecture Overview Technical Brief May 2016 novetta.com 2016, Novetta Novetta Cyber Analytics: Technical Architecture Overview 1 INTRODUCTION 2 CAPTURE AND PROCESS ALL NETWORK TRAFFIC
Implementation of Signature-based Detection System using Snort in Windows
Implementation of Signature-based Detection System using Snort in Windows Prerika Agarwal Sangita Satapathy Ajay Kumar Garg Engineering College, Ghaziabad Abstract: Threats of attacks are increasing day
Exam Questions v8
Exam Questions 412-79v8 EC-Council Certified Security Analyst https://www.2passeasy.com/dumps/412-79v8/ 1.Which of the following password cracking techniques is used when the attacker has some information
Configuring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
Check Point DDoS Protector Simple and Easy Mitigation
Check Point DDoS Protector Simple and Easy Mitigation Jani Ekman janie@checkpoint.com Sales Engineer DDoS Protector 1 (D)DoS Attacks 2 3 4 DDoS Protector Behavioral DoS Protection Summary 2 What is an
Developing the Sensor Capability in Cyber Security
Developing the Sensor Capability in Cyber Security Tero Kokkonen, Ph.D. +358504385317 tero.kokkonen@jamk.fi JYVSECTEC JYVSECTEC - Jyväskylä Security Technology - is the cyber security research, development
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 6 Intrusion Detection First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Intruders significant issue hostile/unwanted
CS4450. Computer Networks: Architecture and Protocols. Lecture 13 THE Internet Protocol. Spring 2018 Rachit Agarwal
CS4450 Computer Networks: Architecture and Protocols Lecture 13 THE Internet Protocol Spring 2018 Rachit Agarwal 2 Reflection The events in last few days have left me sad! Such events must be condemned
CIS Controls Measures and Metrics for Version 7
Level One Level Two Level Three Level Four Level Five Level Six 1.1 Utilize an Active Discovery Tool Utilize an active discovery tool to identify devices connected to the organization's network and update
Check Point DDoS Protector Introduction
Check Point DDoS Protector Introduction Petr Kadrmas SE Eastern Europe pkadrmas@checkpoint.com Agenda 1 (D)DoS Trends 2 3 4 DDoS Protector Overview Protections in Details Summary 2 (D)DoS Attack Methods
OSSIM Fast Guide
----------------- OSSIM Fast Guide ----------------- February 8, 2004 Julio Casal http://www.ossim.net WHAT IS OSSIM? In three phrases: - VERIFICATION may be OSSIM s most valuable contribution
CIS Controls Measures and Metrics for Version 7
Level 1.1 Utilize an Active Discovery Tool 1.2 Use a Passive Asset Discovery Tool 1.3 Use DHCP Logging to Update Asset Inventory 1.4 Maintain Detailed Asset Inventory 1.5 Maintain Asset Inventory Information
Chapter 7. Network Intrusion Detection and Analysis. SeoulTech UCS Lab (Daming Wu)
SeoulTech UCS Lab Chapter 7 Network Intrusion Detection and Analysis 2015. 11. 3 (Daming Wu) Email: wdm1517@gmail.com Copyright c 2015 by USC Lab All Rights Reserved. Table of Contents 7.1 Why Investigate
What are network flows? Using Argus and Postgres to analyse network flows for security
Using Argus and Postgres to analyse network flows for security David Ford OxCERT Oxford University Computer Services What are network flows? A convenient way of representing traffic on your network Contain
THE RSA SUITE NETWITNESS REINVENT YOUR SIEM. Presented by: Walter Abeson
THE RSA NETWITNESS SUITE REINVENT YOUR SIEM Presented by: Walter Abeson 1 Reality Goals GOALS VERSUS REALITY OF SIEM 1.0 Single compliance & security interface Analyze & prioritize alerts across various
INTRUSION DETECTION SYSTEM BASED SNORT USING HIERARCHICAL CLUSTERING
INTRUSION DETECTION SYSTEM BASED SNORT USING HIERARCHICAL CLUSTERING Moch. Zen Samsono Hadi, Entin M. K., Aries Pratiarso, Ellysabeth J. C. Telecommunication Department Electronic Engineering Polytechnic
Extracting Performance and Scalability Metrics from TCP. Baron Schwartz April 2012
Extracting Performance and Scalability Metrics from TCP Baron Schwartz April 2012 Agenda Fundamental Metrics of Performance Capturing TCP Data Part 1: Black-Box Performance Analysis Detecting Stalls and
Detecting Attacks, Part 1
Detecting Attacks, Part 1 CS 161 - Computer Security Profs. Vern Paxson & David Wagner TAs: John Bethencourt, Erika Chin, Matthew Finifter, Cynthia Sturton, Joel Weinberger http://inst.eecs.berkeley.edu/~cs161/
Network Anomaly Detection Using Autonomous System Flow Aggregates
Network Anomaly Detection Using Autonomous System Flow Aggregates Thienne Johnson 1,2 and Loukas Lazos 1 1 Department of Electrical and Computer Engineering 2 Department of Computer Science University
Penetration Testing! The Nitty Gritty. Jeremy Conway Partner/CTO
Penetration Testing! The Nitty Gritty Jeremy Conway Partner/CTO Before I Start What qualifies me to speak about this? It s all important and relevant! Brief History The Past! US Active Army DoD Contractor
INTERNET TRAFFIC MEASUREMENT (PART II) Gaia Maselli
INTERNET TRAFFIC MEASUREMENT (PART II) Gaia Maselli maselli@di.uniroma1.it Prestazioni dei sistemi di rete 2 Overview Basic concepts Characterization of traffic properties that are important to measure
SCP SC Network Defense and Countermeasures (NDC) Exam.
SCP SC0-402 Network Defense and Countermeasures (NDC) Exam TYPE: DEMO http://www.examskey.com/sc0-402.html Examskey SCP SC0-402 exam demo product is here for you to test the quality of the product. This
Distributed Systems. 29. Firewalls. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 29. Firewalls Paul Krzyzanowski Rutgers University Fall 2015 2013-2015 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive data & systems not accessible Integrity:
Network Security Monitoring: An Open Community Approach
Network Security Monitoring: An Open Community Approach IUP- Information Assurance Day, 2011 Greg Porter 11/10/11 Agenda Introduction Current State NSM & Open Community Options Conclusion 2 Introduction
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems Section 1: Command Line Tools Skill 1: Employ commands using command line interface 1.1 Use command line commands to gain situational
BIG-IP Local Traffic Management: Basics. Version 12.1
BIG-IP Local Traffic Management: Basics Version 12.1 Table of Contents Table of Contents Introduction to Local Traffic Management...7 About local traffic management...7 About the network map...7 Viewing
DO NOT OPEN UNTIL INSTRUCTED
CS 378 - Network Security and Privacy Spring 2017 FINAL May 3, 2017 DO NOT OPEN UNTIL INSTRUCTED YOUR NAME: Collaboration policy No collaboration is permitted on this exam. Any cheating (e.g., submitting
Configuring Anomaly Detection
CHAPTER 12 This chapter describes how to create multiple security policies and apply them to individual virtual sensors. It contains the following sections: Understanding Policies, page 12-1 Anomaly Detection
Network Security Monitoring (NSM) Using
Network Security Monitoring (NSM) Using James Kirn 9/20/17 Based on Material from Doug Burks Presentation 2014_017_001_90218 North West Chicagoland Linux User Group (NWCLUG) -10.2017 1 Problem All our
Honeynet Data Analysis: A technique for correlating sebek and network data
Honeynet Data Analysis: A technique for correlating sebek and network data Edward G. Balas Indiana University Advanced Network Management Lab 6/15/2004 About the Author Edward G. Balas Security Researcher
CNIT 50: Network Security Monitoring. 6 Command Line Packet Analysis Tools
CNIT 50: Network Security Monitoring 6 Command Line Packet Analysis Tools Topics SO Tool Categories Running Tcpdump Using Dumpcap and Tshark Running Argus and the Ra Client SO Tool Categories Three Types
The Bro Cluster The Bro Cluster
The Bro Cluster The Bro Cluster Intrusion Detection at 10 Gig and A High-Performance beyond using the NIDS Bro Architecture IDS for the Lawrence Berkeley National Lab Robin International Computer Science
Intrusion Detection System
Intrusion Detection System Marmagna Desai March 12, 2004 Abstract This report is meant to understand the need, architecture and approaches adopted for building Intrusion Detection System. In recent years
Anonymous Communication and Internet Freedom
Anonymous Communication and Internet Freedom CS 161: Computer Security Prof. David Wagner May 2, 2013 Goals For Today State-sponsored adversaries Anonymous communication Internet censorship State-Sponsored
Design and Implementation of Real-time Visualization tool for Network Security Monitoring
Design and Implementation of Real-time Visualization tool for Network Security Monitoring Aneela Safdar Supervisor : Dr. Hanif Durad Co-Supervisor : M. Masoom Alam DCIS PIEAS Motivation To look what s
Basic Concepts in Intrusion Detection
Technology Technical Information Services Security Engineering Roma, L Università Roma Tor Vergata, 23 Aprile 2007 Basic Concepts in Intrusion Detection JOVAN GOLIĆ Outline 2 Introduction Classification
Anonymous Communication and Internet Freedom
Anonymous Communication and Internet Freedom CS 161: Computer Security Prof. David Wagner April 29, 2016 Announcements Final exam in RSF Fieldhouse, 5/10, arrive by 7PM HW4 due Monday, 5/2, 11:59pm Review
Intruders, Human Identification and Authentication, Web Authentication
Intruders, Human Identification and Authentication, Web Authentication David Sanchez Universitat Pompeu Fabra 06-06-2006 Lecture Overview Intruders and Intrusion Detection Systems Human Identification
Work Book. Sharkfest Presentation Material. Copyright Advance Seven Limited. All rights reserved.
Work Book Presentation Material Copyright 1995-2013 Advance Seven Limited. All rights reserved. Advance Seven Limited Melville House High Street Dunmow Essex CM6 1AF United Kingdowm Table of Contents 1
Configuring Anomaly Detection
CHAPTER 9 Caution Anomaly detection assumes it gets traffic from both directions. If the sensor is configured to see only one direction of traffic, you should turn off anomaly detection. Otherwise, when
Configuring Anomaly Detection
CHAPTER 9 This chapter describes anomaly detection and its features and how to configure them. It contains the following topics: Understanding Security Policies, page 9-2 Understanding Anomaly Detection,
Octoshape. Commercial hosting not cable to home, founded 2003
Octoshape Commercial hosting not cable to home, founded 2003 Broadcasting fee is paid by broadcasters Free for consumers Audio and Video, 32kbps to 800kbps Mesh based, bit-torrent like, Content Server
Chapter 7. Denial of Service Attacks
Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU),
WHY SIEMS WITH ADVANCED NETWORK- TRAFFIC ANALYTICS IS A POWERFUL COMBINATION. A Novetta Cyber Analytics Brief
WHY SIEMS WITH ADVANCED NETWORK- TRAFFIC ANALYTICS IS A POWERFUL COMBINATION A Novetta Cyber Analytics Brief Why SIEMs with advanced network-traffic analytics is a powerful combination. INTRODUCTION Novetta
Distributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
Abstract. Keywords: Virus, inetmon Engine, Virus Parser, Virus Matching Engine. 1. Introduction
Real-Time Detection System Using inetmon Engine Sureswaran Ramadass, Azlan Bin Osman, Rahmat Budiarto, N. Sathiananthan, Ng Chin Keong, Choi Sy Jong Network Research Group, School Of Computer Science,
Double Guard: Detecting intrusions in Multitier web applications with Security
ISSN 2395-1621 Double Guard: Detecting intrusions in Multitier web applications with Security #1 Amit Patil, #2 Vishal Thorat, #3 Amit Mane 1 amitpatil1810@gmail.com 2 vishalthorat5233@gmail.com 3 amitmane9975@gmail.com
A Study on Intrusion Detection Techniques in a TCP/IP Environment
A Study on Intrusion Detection Techniques in a TCP/IP Environment C. A. Voglis and S. A. Paschos Department of Computer Science University of Ioannina GREECE Abstract: The TCP/IP protocol suite is the
SAP Cybersecurity Solution Brief. Objectives Solution Benefits Quick Facts
SAP Cybersecurity Solution Brief Objectives Solution Benefits Quick Facts Secure your SAP landscapes from cyber attack Identify and remove cyber risks in SAP landscapes Perform gap analysis against compliance
Incident Response. Figure 10-1: Incident Response. Figure 10-2: Program and Data Backup. Figure 10-1: Incident Response. Figure 10-2: Program and Data
Figure 10-1: Incident Response Incident Response Chapter 10 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Incidents Happen Protections sometimes break down Incident Severity
Enhancing Byte-Level Network Intrusion Detection Signatures with Context
Enhancing Byte-Level Network Intrusion Detection Signatures with Context Robin Sommer sommer@in.tum.de Technische Universität München Germany Vern Paxson vern@icir.org International Computer Science Institute
ANOMALY DETECTION IN COMMUNICTION NETWORKS
Anomaly Detection Summer School Lecture 2014 ANOMALY DETECTION IN COMMUNICTION NETWORKS Prof. D.J.Parish and Francisco Aparicio-Navarro Loughborough University (School of Electronic, Electrical and Systems
CISNTWK-440. Chapter 5 Network Defenses
CISNTWK-440 Intro to Network Security Chapter 5 Network Defenses 1 Objectives Explain how to enhance security through network design Define network address translation and network access control List the
Measurement: Techniques, Strategies, and Pitfalls. David Andersen CMU
Measurement: Techniques, Strategies, and Pitfalls David Andersen CMU 15-744 Many (most) slides in this lecture from Nick Feamster's measurement lecture Internet Measurement Process of collecting data that
Novetta Cyber Analytics
Know your network. Arm your analysts. Introduction Novetta Cyber Analytics is an advanced network traffic analytics solution that empowers analysts with comprehensive, near real time cyber security visibility
Intrusion Detection Systems
Intrusion Detection Systems Dr. Ahmad Almulhem Computer Engineering Department, KFUPM Spring 2008 Ahmad Almulhem - Network Security Engineering - 2008 1 / 15 Outline 1 Introduction Overview History 2 Types
Router and ACL ACL Filter traffic ACL: The Three Ps One ACL per protocol One ACL per direction One ACL per interface
CCNA4 Chapter 5 * Router and ACL By default, a router does not have any ACLs configured and therefore does not filter traffic. Traffic that enters the router is routed according to the routing table. *
Feature Selection in the Corrected KDD -dataset
Feature Selection in the Corrected KDD -dataset ZARGARI, Shahrzad Available from Sheffield Hallam University Research Archive (SHURA) at: http://shura.shu.ac.uk/17048/ This document is the author deposited
Configuring Event Monitoring
CHAPTER 19 This chapter describes IME event monitoring and how to configure it. It contains the following sections: Understanding Event Monitoring, page 19-1 Understanding Grouping and Color Rules, page
Multi-phase IRC Botnet & Botnet Behavior Detection Model
Software Verification and Validation Multi-phase IRC Botnet & Botnet Behavior Detection Model Aymen AlAwadi aymen@tmit.bme.hu Budapest university of technology and economics Department of Telecommunications
Hillstone T-Series Intelligent Next-Generation Firewall Whitepaper: Abnormal Behavior Analysis
Hillstone T-Series Intelligent Next-Generation Firewall Whitepaper: Abnormal Behavior Analysis Keywords: Intelligent Next-Generation Firewall (ingfw), Unknown Threat, Abnormal Parameter, Abnormal Behavior,
Security Principles SNORT - IDS
Security Principles SNORT - IDS Intrusion detection What is intrusion detection? Technically, any method that allows you to discover if someone has penetrated or is attempting intrusion into your network,
Intrusion Detection and Prevention
Intrusion Detection and Prevention Outlines: Intrusion Tpesof Types Intrusion Intrusion Detection Models Intrusion Prevention Models By: Arash Habibi Lashkari July 2010 Network Security 07 1 Definition
Isolating Compromised Routers. Alper Mizrak, Keith Marzullo and Stefan Savage UC San Diego Department of Computer Science and Engineering
Isolating Compromised Routers Alper Mizrak, Keith Marzullo and Stefan Savage UC San Diego Department of Computer Science and Engineering Problem Routers are vulnerable points in the Internet, especially
this security is provided by the administrative authority (AA) of a network, on behalf of itself, its customers, and its legal authorities
INFRASTRUCTURE SECURITY this security is provided by the administrative authority (AA) of a network, on behalf of itself, its customers, and its legal authorities Goals * prevent or mitigate resource attacks
A SIMPLE INTRODUCTION TO TOR
A SIMPLE INTRODUCTION TO TOR The Onion Router Fabrizio d'amore May 2015 Tor 2 Privacy on Public Networks Internet is designed as a public network Wi-Fi access points, network routers see all traffic that
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
A Rule-Based Intrusion Alert Correlation System for Integrated Security Management *
A Rule-Based Intrusion Correlation System for Integrated Security Management * Seong-Ho Lee 1, Hyung-Hyo Lee 2, and Bong-Nam Noh 1 1 Department of Computer Science, Chonnam National University, Gwangju,
Different attack manifestations Network packets OS calls Audit records Application logs Different types of intrusion detection Host vs network IT
Different attack manifestations Network packets OS calls Audit records Application logs Different types of intrusion detection Host vs network IT environment (e.g., Windows vs Linux) Levels of abstraction
01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED
01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED Contents 1. Introduction 3 2. Security Testing Methodologies 3 2.1 Internet Footprint Assessment 4 2.2 Infrastructure Assessments
Intrusion Detection Systems Overview
Intrusion Detection Systems Overview Chris Figueroa East Carolina University figueroac13@ecu.edu Abstract Modern intrusion detection systems provide a first line of defense against attackers for organizations.
ENTERPRISE ENDPOINT PROTECTION BUYER S GUIDE
ENTERPRISE ENDPOINT PROTECTION BUYER S GUIDE TABLE OF CONTENTS Overview...3 A Multi-Layer Approach to Endpoint Security...4 Known Attack Detection...5 Machine Learning...6 Behavioral Analysis...7 Exploit
I Was APT d. What Did They Steal?
I Was APT d. What Did They Steal? Marcus H. Sachs, P.E. Verizon October 19, 2011 All Is Not Lost Just because you found the APT in your system (or were told by a third party that you ve been 0wn3d) doesn
White Paper. Why IDS Can t Adequately Protect Your IoT Devices
White Paper Why IDS Can t Adequately Protect Your IoT Devices Introduction As a key component in information technology security, Intrusion Detection Systems (IDS) monitor networks for suspicious activity
CSE 403 Spring UDub Mail. Gabriel Maganis Sachin Pradhan. April 04, 2006
CSE 403 Spring 2006 UDub Mail Gabriel Maganis Sachin Pradhan April 04, 2006 Operational Concepts Scenario Paul Wall, a UW student got admitted into the CSE department and gets his @cs.washington.edu e-mail