Topological Analysis and Visualisation of Network Monitoring Data: Darknet case study - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

Topological Analysis and Visualisation of Network Monitoring Data: Darknet case study

Résumé

Network monitoring is a primordial source of data in cyber-security since it may reveal abnormal behaviors of users or applications. Indeed, security analysts and tools like IDS (Intrusion Detection system) or SIEM (security information and event management) rely on them as a single source of information or combined with others. In this paper, we propose a visualisation method derived from the Mapper algorithm that has been developed in the field of Topological Data Analysis (TDA). The developed method and its associated tool are able to analyze a large number of IP packets in order to make malicious activities patterns easily observable by security analysts. We applied our method to darknet data, \textit{i.e.} from an entire and supposed not used subnetwork in Internet and we have found that those observable patterns have been missed by Suricata, a widely used State-of-the-Art IDS.
Fichier principal
Vignette du fichier
wifs16.pdf (671.67 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01403950 , version 1 (28-11-2016)

Identifiants

  • HAL Id : hal-01403950 , version 1

Citer

Marc Coudriau, Abdelkader Lahmadi, Jerome Francois. Topological Analysis and Visualisation of Network Monitoring Data: Darknet case study. 8th IEEE International Workshop on Information Forensics and Security - WIFS 2016, Dec 2016, Abu Dhabi, United Arab Emirates. ⟨hal-01403950⟩
621 Consultations
1809 Téléchargements

Partager

Gmail Facebook X LinkedIn More