Search

Traditional intrusion detection and logfile analysis are no longer enough to protect today's complex networks. In the updated second edition of this practical guide, security researcher Michael Collins shows InfoSec personnel the latest techniques and tools for collecting and analyzing network traffic datasets. You'll understand how your network is used, and what actions are necessary to harden and defend the systems within it.In three sections, this book examines the process of collecting and organizing data, various tools for analysis, and several different analytic scenarios and techniques. New chapters focus on active monitoring and traffic manipulation, insider threat detection, data mining, regression and machine learning, and other topics.You'll learn how to:Use sensors to collect network, service, host, and active domain dataWork with the SiLK toolset, Python, and other tools and techniques for manipulating data you collectDetect unusual phenomena through exploratory data analysis (EDA), using visualization and mathematical techniquesAnalyze text data, traffic behavior, and communications mistakesIdentify significant structures in your network with graph analysisExamine insider threat data and acquire threat intelligenceMap your network and identify significant hosts within itWork with operations to develop defenses and analysis techniques

Networks and Network Analysis for Defence and Security discusses relevant theoretical frameworks and applications of network analysis in support of the defence and security domains. This book details real world applications of network analysis to support defence and security. Shocks to regional, national and global systems stemming from natural hazards, acts of armed violence, terrorism and serious and organized crime have significant defence and security implications. Today, nations face an uncertain and complex security landscape in which threats impact/target the physical, social, economic and cyber domains. Threats to national security, such as that against critical infrastructures not only stem from man-made acts but also from natural hazards. Katrina (2005), Fukushima (2011) and Hurricane Sandy (2012) are examples highlighting the vulnerability of critical infrastructures to natural hazards and the crippling effect they have on the social and economic well-being of a communityand a nation. With this dynamic and complex threat landscape, network analysis has emerged as a key enabler in supporting defence and security. With the advent of ‘big data'and increasing processing power, network analysis can reveal insights with regards to structural and dynamic properties thereby facilitating greater understanding of complex networks, their entities, interdependencies, vulnerabilities to produce insights for creative solutions. This book will be well positioned to inform defence, security and intelligence professionals and researchers with regards to leading methodologies and approaches.

Traditional intrusion detection and logfile analysis are no longer enough to protect today's complex networks. In this practical guide, security researcher Michael Collins shows you several techniques and tools for collecting and analyzing network traffic datasets. You'll understand how your network is used, and what actions are necessary to protect and improve it.Divided into three sections, this book examines the process of collecting and organizing data, various tools for analysis, and several different analytic scenarios and techniques. It's ideal for network administrators and operational security analysts familiar with scripting.Explore network, host, and service sensors for capturing security dataStore data traffic with relational databases, graph databases, Redis, and HadoopUse SiLK, the R language, and other tools for analysis and visualizationDetect unusual phenomena through Exploratory Data Analysis (EDA)Identify significant structures in networks with graph analysisDetermine the traffic that's crossing service ports in a networkExamine traffic volume and behavior to spot DDoS and database raidsGet a step-by-step process for network mapping and inventory