|
This article is cited in 1 scientific paper (total in 1 paper)
Of presenting the results of network traffic analysis
A. I. Get'mana, Yu. V. Markina, D. O. Obydenkova, V. A. Padaryanab, A. Yu. Tikhonova a Institute for System Programming of the Russian Academy of Sciences
b Lomonosov Moscow State University
Abstract:
The article proposes different methods of presenting network traffic analysis results, the need for which arises primarily in the area of network security. One of the most important tasks is to identify malicious traffic. For this purpose both the complete graph of network interactions and time-based packet diagram are presented. These components are used during investigation of information security violation incidents. The timing diagram is also used in analysis of tunneling protocols because it allows the analyst to determine which protocol headers are necessary to visualize. For tasks associated with reverse engineering and debugging of network protocols, it is proposed to use a journal which records protocol header parsing errors. Presented graphic components either have no analogues among the opensource tools or improve on existing opensource solutions.
Keywords:
network traffic analysis, network protocols debugging, graph of network interactions, visualization, error log.
Citation:
A. I. Get'man, Yu. V. Markin, D. O. Obydenkov, V. A. Padaryan, A. Yu. Tikhonov, “Of presenting the results of network traffic analysis”, Proceedings of ISP RAS, 28:6 (2016), 103–110
Linking options:
https://www.mathnet.ru/eng/tisp87 https://www.mathnet.ru/eng/tisp/v28/i6/p103
|
Statistics & downloads: |
Abstract page: | 204 | Full-text PDF : | 79 | References: | 29 |
|