Network Security through Data Analysis by Michael Collins

Network Security through Data Analysis

Traditional intrusion detection and logfile analysis are no longer enough to protect today’s complex networks. In the updated second edition of this practical guide, security researcher Michael Collins shows InfoSec personnel the latest techniques and tools for collecting and analyzing network traffic datasets. You’ll understand how your network is used, and what actions are necessary to harden and defend the systems within it.
In three sections, this book examines the process of collecting and organizing data, various tools for analysis, and several different analytic scenarios and techniques. New chapters focus on active monitoring and traffic manipulation, insider threat detection, data mining, regression and machine learning, and other topics.
You’ll learn how to:

• Use sensors to collect network, service, host, and active domain data
• Work with the SiLK toolset, Python, and other tools and techniques for manipulating data you collect
• Detect unusual phenomena through exploratory data analysis (EDA), using visualization and mathematical techniques
• Analyze text data, traffic behavior, and communications mistakes
• Identify significant structures in your network with graph analysis
• Examine insider threat data and acquire threat intelligence
• Map your network and identify significant hosts within it
• Work with operations to develop defenses and analysis techniques

Source: Amazon.com

Contents

This book is divided into three sections: Data, Tools, and Analytics. The Data section discusses the process of collecting and organizing data. The Tools section discusses a number of different tools to support analytical processes. The Analytics section discusses different analytic scenarios and techniques. Here’s a bit more detail on what you’ll find in each.

Download Magazines

Part I discusses the collection, storage, and organization of data. Data storage and logistics are critical problems in security analysis; it’s easy to collect data, but hard to search through it and find actual phenomena. Data has a footprint, and it’s possible to collect so much data that you can never meaningfully search through it. This section is divided into the following chapters:

Chapter 1
This chapter discusses the general process of collecting data. It provides a framework for exploring how different sensors collect and report information and how they interact with each other, and how the process of data collection affects the data collected and the inferences made.

Chapter 2
This chapter expands on the discussion in the previous chapter by focusing on sensor placement in networks. This includes points about how packets are transferred around a network and the impact on collecting these packets, and how various types of common network hardware affect data collection.

Read more > Network Security through Data Analysis by Michael Collins