Network Security Through Data Analysis: Building Situational Awareness Author: Michael Collins | Language: English | ISBN:
1449357903 | Format: EPUB
Network Security Through Data Analysis: Building Situational Awareness Description
Traditional intrusion detection and logfile analysis are no longer enough to protect today’s complex networks. In this practical guide, security researcher Michael Collins shows you several techniques and tools for collecting and analyzing network traffic datasets. You’ll understand how your network is used, and what actions are necessary to protect and improve it.
Divided into three sections, this book examines the process of collecting and organizing data, various tools for analysis, and several different analytic scenarios and techniques. It’s ideal for network administrators and operational security analysts familiar with scripting.
- Explore network, host, and service sensors for capturing security data
- Store data traffic with relational databases, graph databases, Redis, and Hadoop
- Use SiLK, the R language, and other tools for analysis and visualization
- Detect unusual phenomena through Exploratory Data Analysis (EDA)
- Identify significant structures in networks with graph analysis
- Determine the traffic that’s crossing service ports in a network
- Examine traffic volume and behavior to spot DDoS and database raids
- Get a step-by-step process for network mapping and inventory
- Paperback: 348 pages
- Publisher: O'Reilly Media; 1 edition (February 23, 2014)
- Language: English
- ISBN-10: 1449357903
- ISBN-13: 978-1449357900
- Product Dimensions: 9.2 x 7.1 x 0.7 inches
- Shipping Weight: 1.3 pounds (View shipping rates and policies)
The book takes considerable time to explain traffic in general, sensing traffic and the logistics around making sense of network data both at the simplistic and the next level of analysis. Anyone who has a solid understanding or working in network monitoring can skip ahead to the more interesting analysis techniques at each layer of traffic, using fundamental principals and visualization to find potential threats.
The exploration of volume and time analysis was particularly interesting to me as I do similar work however, only goes far enough to give the reader or anyone willing to try the code presented in the book an idea of what is to be expected. Probably wise of the author not to go too deep and demonstrate a wide range of analysis missing in data centers and security operations.
I found the book to insightful and useful and good for anyone looking to make the leap to the higher echelons of detection.
By KEVIN M NOBLE
Network Security Through Data Analysis: Building Situational Awareness Preview
Link
Please Wait...