• No results found

Merging Network Configuration and Network Traffic Data in ISP-Level Analyses

N/A
N/A
Protected

Academic year: 2021

Share "Merging Network Configuration and Network Traffic Data in ISP-Level Analyses"

Copied!
10
0
0

Loading.... (view fulltext now)

Full text

(1)

Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213

Merging Network

Configuration and

Network Traffic Data in

ISP-Level Analyses

(2)

Copyright 2016 Carnegie Mellon University

This material is based upon work funded and supported by the Department of Defense under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center.

NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR

MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.

[Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution.

This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at permission@sei.cmu.edu. Carnegie Mellon® and CERT® are registered marks of Carnegie Mellon University.

(3)

The Network Data Flood

Analyst Needs

Merger Methods

Examples of Merger

Practical Tips

Overview

(4)

Network Data Flood

?

Network

Configuration

Host identification Host criticality Host configuration Vulnerability scan Vulnerability impact Subnet relations

Network

Traffic Network Flows Packet captures Alerts Route information Address resolutions

(5)

Network observation

What behaviors are seen from hosts of configuration X?

What configurations contribute to the volume of behavior Y?

Network orientation

Which configurations have vulnerabilities scanned for during event Z?

Which hosts are running the services exploited during event Z?

Network understanding

How difficult is it to apply patch Q on this network?

What issues would be involved in blocking service R on this network?

Network prediction

What is likely to follow event Z due to our traffic and configuration?

How likely are our customers to be affected by event Z?

(6)

Config-first: Using configuration to drive network traffic analysis

Traffic-first: Using traffic to drive network configuration analysis

Deep-dive: Goals-Questions-Metrics

Sandwich: Iterate between traffic and configuration driving analysis

(7)

Assessing encryption

Start with hosts configured as servers for encrypted services

Filter packets/flows/logs for those servers to generate profiles

Identify common users of services

Filter for other network points of contact for those users

Associate services and configuration associated with those

points

Network attack impact

Start with traffic indicators of attack

Generate set of network hosts involved with indicators

Associate services and configurations with hosts

Filter for contacts

Identify vulnerable configurations in contacts

(8)

Watch for topology mismatches

Watch for NAT issues

Try the simple approach first

Generalize from working approaches

Do not try to solve the insolvable

(9)

Conclusion

Challenges

Methods exist

Don’t try to be too generic: you can

extrapolate from what works

Need to take into account human and

automated advantages

(10)

Timothy Shimeall

Senior Member of the Technical Staff

Telephone: +1 412.268.7611

Email: tjs@cert.org

References

Related documents

To be more specific, our analysis shows that the recent improvement that took place along the distribution of total household per-capita income, after more than 15 years of high

Comparative systematic reviews evaluating responses in early RA and the impact of treatment on erosive damage show no added benefits from treat- ments with biologics in

Berdasarkan Gambar 4, terlihat bahwa pada tingkat kesamaan 57,3%, ke- lompok habitat pertama ditempati oleh Sta- siun 4 yang dicirikan dengan tingginya nilai kelimpahan

According to the following theorem, a NE exists as long as admission control is able to guarantee that a slice can satisfy the rate requirements of all its users under any

Fixed Deposits – They cover the fixed deposits of varied tenors offered by the commercial banks and other non-banking financial institutions. These are generally a low

PTFs-1: TCC and track circuits’ failures updated the track circuits’ signals breaking the train tracing condition for safety [related to physical development]; PFTs-2:

Cuando somos llamados al servicio en condiciones difíciles, tendremos que recordar ese amor de Jesús, para que nos dé inspiración y fuerzas para servir por amor!. En San Juan y

Indeed, as we have seen above, holding organizational capital …xed, a …rm endowed with greater managerial e¢ ciency > optimally chooses to manage a smaller number of products,