Automating Network Security Analysis at Packet-level by using Rule-based Engine

conference paper

English

When a network incident is detected, a network administrator has to manually verify the incident and provide a solution to stop the incident from continuing and prevent similar incidents in the future. The network analysis is a time-consuming and labor-intensive activity which requires good network knowledge. Creating a solution which automates the administrator's work can dramatically speed up the analysis process and can make the whole process easier for less experienced administrators. In this paper, we describe a method that uses a predefined set of rules to identify incident patterns. Though this principle is used by many security tools, the new aspect is that the presented approach uses the Wireshark tool which is well known among the administrators, and it is expressive enough to specify complex relations among source data thus being able to detect quite sophisticated attacks. The created rule's format uses the same language as the Wireshark filters.

Network security, network monitoring, anomaly detection, threat detection, network forensics

HOLKOVIČ, M.; RYŠAVÝ, O.; DUDEK, J.

1. 9. 2019

Association for Computing Machinery

Bucharest

978-1-4503-7636-5

Proceedings of the Sixth European Conference on the Engineering of Computer-Based Systems

1

8

8

https://www.fit.vut.cz/research/publication/12011/

a14-holkovic.pdf