We are students from SRM University pursuing B.TECH in Computer Science Department. We took a small initiative to make a PPT about how network traffic can be analyzed through Cyber Security. We have also mentioned the known network analyzers and future scope for network traffic analysis with cyber security.
The growth of embedded systems connecting to the Internet or "Internet of Things" (IoT) increases year by year. Thus, the IoT ecosystems become new targets of the attackers. This presentation will talk about the basic principle of information security, why we need to secure IoT ecosystems, and also the vulnerabilities and solutions from OWASP.
The growth of embedded systems connecting to the Internet or "Internet of Things" (IoT) increases year by year. Thus, the IoT ecosystems become new targets of the attackers. This presentation will talk about the basic principle of information security, why we need to secure IoT ecosystems, and also the vulnerabilities and solutions from OWASP.
Intrusion detection and prevention systemNikhil Raj
This presentation describes how to implement Network based Intrusion Detection System (SNORT) in the network. Detecting and analyzing alerts generated and blocking the Attacker using Access Control List.
Intrusion Detection Systems and Intrusion Prevention Systems Cleverence Kombe
Intrusion detection system (IDS) is software that automates the intrusion detection process. The primary responsibility of an IDS is to detect unwanted and malicious activities. Intrusion prevention system (IPS) is software that has all the capabilities of an intrusion detection system and can also attempt to stop possible incidents.
Network sniffers & injection tools
Network Threats Attack
Specific Attack Types
Network Sniffer
How does a Sniffer Work?
How can I detect a packet sniffer?
Packet Sniffer Mitigation
Injection Tools
About Port Scanning
Used Nmap and Shadow Security scanner for the best outputs.
A Detailed description on performing the port scanning mostly for the network administrators.
Why to perform? How to perform? Where to perform? these areas are taken into consideration and presented with best output results using tools "nmap scanner" and "shadow security scanner".
The development of intelligent network forensic tools to focus on specific type of network traffic analysis is a challenge in terms of future perspective.
This will reduce time delays, less computational resources requirement; minimize attacks, providing reliable and secured evidences, and efficient investigation with minimum efforts
The IoT Era Begins
Components of IoT-Enabled Things
IoT Reference model
IoT Security
IoT Security & Privacy Req. defined by ITU-T
An IoT Security Framework
IoT Security Challenges
Internet of Things - Liability
IoT security tools
In computing, a denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet - Wikipedia
This seminar discuss about the TOR BROWSER NETWORK TECHNOLOGY. The discussion includes, How it works, its weakness, its advantage, hidden services, about anonymity etc.
Prensentation on packet sniffer and injection toolIssar Kapadia
The presentation is about scanning tools: packet sniffer and injection tools. how is this scanning tools are use which is describe in this presentation.
Intrusion detection and prevention systemNikhil Raj
This presentation describes how to implement Network based Intrusion Detection System (SNORT) in the network. Detecting and analyzing alerts generated and blocking the Attacker using Access Control List.
Intrusion Detection Systems and Intrusion Prevention Systems Cleverence Kombe
Intrusion detection system (IDS) is software that automates the intrusion detection process. The primary responsibility of an IDS is to detect unwanted and malicious activities. Intrusion prevention system (IPS) is software that has all the capabilities of an intrusion detection system and can also attempt to stop possible incidents.
Network sniffers & injection tools
Network Threats Attack
Specific Attack Types
Network Sniffer
How does a Sniffer Work?
How can I detect a packet sniffer?
Packet Sniffer Mitigation
Injection Tools
About Port Scanning
Used Nmap and Shadow Security scanner for the best outputs.
A Detailed description on performing the port scanning mostly for the network administrators.
Why to perform? How to perform? Where to perform? these areas are taken into consideration and presented with best output results using tools "nmap scanner" and "shadow security scanner".
The development of intelligent network forensic tools to focus on specific type of network traffic analysis is a challenge in terms of future perspective.
This will reduce time delays, less computational resources requirement; minimize attacks, providing reliable and secured evidences, and efficient investigation with minimum efforts
The IoT Era Begins
Components of IoT-Enabled Things
IoT Reference model
IoT Security
IoT Security & Privacy Req. defined by ITU-T
An IoT Security Framework
IoT Security Challenges
Internet of Things - Liability
IoT security tools
In computing, a denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet - Wikipedia
This seminar discuss about the TOR BROWSER NETWORK TECHNOLOGY. The discussion includes, How it works, its weakness, its advantage, hidden services, about anonymity etc.
Prensentation on packet sniffer and injection toolIssar Kapadia
The presentation is about scanning tools: packet sniffer and injection tools. how is this scanning tools are use which is describe in this presentation.
Wireshark tool has been a staple favourite of cybersecurity engineers for reasons more than one. This open-source network analyser helps in packet sniffing, troubleshooting network problems, and investigating security incidents. If you want to know more about Wireshark this blog here is perfect for you since it offers a detailed account of the major features of the tool. Alongside, the blog also talks about the interfaces supported by Wireshark and its multiple benefits. You will even get to know about the top competitors of the tool from this article.
The presentation provides a topical overview of the areas to be looked at when conducting a Firewall, Router, or Switch configuration review. This presentation is based on a slide deck I prepared for an internal Learning & Growth session in March of 2014. More detailed material is available from the "References" slide.
Tools and Mechanisms for Network Security in an Organization.
Physical Security, Administrative Security and Technical Security measures have been described.
Security Testing Tools are Nessus, THC Hydra, Kismet, Nikto, WireShark and NMAP.
Splunk for Security: Background & Customer Case StudyAndrew Gerber
Presented at SplunkLive! Denver on August 4, 2015; provides background on the Splunk value proposition for security use cases based on actual experience, a walkthrough of a Splunk engagement at a major national healthcare customer, and examples of three use cases that provided actionable value beyond what was possible with the previous SIEM solution.
Synthetic Fiber Construction in lab .pptxPavel ( NSTU)
Synthetic fiber production is a fascinating and complex field that blends chemistry, engineering, and environmental science. By understanding these aspects, students can gain a comprehensive view of synthetic fiber production, its impact on society and the environment, and the potential for future innovations. Synthetic fibers play a crucial role in modern society, impacting various aspects of daily life, industry, and the environment. ynthetic fibers are integral to modern life, offering a range of benefits from cost-effectiveness and versatility to innovative applications and performance characteristics. While they pose environmental challenges, ongoing research and development aim to create more sustainable and eco-friendly alternatives. Understanding the importance of synthetic fibers helps in appreciating their role in the economy, industry, and daily life, while also emphasizing the need for sustainable practices and innovation.
The Roman Empire A Historical Colossus.pdfkaushalkr1407
The Roman Empire, a vast and enduring power, stands as one of history's most remarkable civilizations, leaving an indelible imprint on the world. It emerged from the Roman Republic, transitioning into an imperial powerhouse under the leadership of Augustus Caesar in 27 BCE. This transformation marked the beginning of an era defined by unprecedented territorial expansion, architectural marvels, and profound cultural influence.
The empire's roots lie in the city of Rome, founded, according to legend, by Romulus in 753 BCE. Over centuries, Rome evolved from a small settlement to a formidable republic, characterized by a complex political system with elected officials and checks on power. However, internal strife, class conflicts, and military ambitions paved the way for the end of the Republic. Julius Caesar’s dictatorship and subsequent assassination in 44 BCE created a power vacuum, leading to a civil war. Octavian, later Augustus, emerged victorious, heralding the Roman Empire’s birth.
Under Augustus, the empire experienced the Pax Romana, a 200-year period of relative peace and stability. Augustus reformed the military, established efficient administrative systems, and initiated grand construction projects. The empire's borders expanded, encompassing territories from Britain to Egypt and from Spain to the Euphrates. Roman legions, renowned for their discipline and engineering prowess, secured and maintained these vast territories, building roads, fortifications, and cities that facilitated control and integration.
The Roman Empire’s society was hierarchical, with a rigid class system. At the top were the patricians, wealthy elites who held significant political power. Below them were the plebeians, free citizens with limited political influence, and the vast numbers of slaves who formed the backbone of the economy. The family unit was central, governed by the paterfamilias, the male head who held absolute authority.
Culturally, the Romans were eclectic, absorbing and adapting elements from the civilizations they encountered, particularly the Greeks. Roman art, literature, and philosophy reflected this synthesis, creating a rich cultural tapestry. Latin, the Roman language, became the lingua franca of the Western world, influencing numerous modern languages.
Roman architecture and engineering achievements were monumental. They perfected the arch, vault, and dome, constructing enduring structures like the Colosseum, Pantheon, and aqueducts. These engineering marvels not only showcased Roman ingenuity but also served practical purposes, from public entertainment to water supply.
Palestine last event orientationfvgnh .pptxRaedMohamed3
An EFL lesson about the current events in Palestine. It is intended to be for intermediate students who wish to increase their listening skills through a short lesson in power point.
Acetabularia Information For Class 9 .docxvaibhavrinwa19
Acetabularia acetabulum is a single-celled green alga that in its vegetative state is morphologically differentiated into a basal rhizoid and an axially elongated stalk, which bears whorls of branching hairs. The single diploid nucleus resides in the rhizoid.
Read| The latest issue of The Challenger is here! We are thrilled to announce that our school paper has qualified for the NATIONAL SCHOOLS PRESS CONFERENCE (NSPC) 2024. Thank you for your unwavering support and trust. Dive into the stories that made us stand out!
Instructions for Submissions thorugh G- Classroom.pptxJheel Barad
This presentation provides a briefing on how to upload submissions and documents in Google Classroom. It was prepared as part of an orientation for new Sainik School in-service teacher trainees. As a training officer, my goal is to ensure that you are comfortable and proficient with this essential tool for managing assignments and fostering student engagement.
Unit 8 - Information and Communication Technology (Paper I).pdfThiyagu K
This slides describes the basic concepts of ICT, basics of Email, Emerging Technology and Digital Initiatives in Education. This presentations aligns with the UGC Paper I syllabus.
Introduction to AI for Nonprofits with Tapp NetworkTechSoup
Dive into the world of AI! Experts Jon Hill and Tareq Monaur will guide you through AI's role in enhancing nonprofit websites and basic marketing strategies, making it easy to understand and apply.
2. CONTENTS
• INTRODUCTION
• WHAT IS CYBER SECURITY?
• WHAT IS NETWORK TRAFFIC ANALYSIS?
• NEED OF NETWORK ANALYSIS
• HOW TO SOLVE NETWORK NETWORK TRAFFIC?
• FEATURES OF NETWORK TRAFFIC ANALYSIS
• NETWORK ANALYZERS
• IMPORTANCE OF NETWORK TRAFFIC ANALYSIS
• USE CASES FOR ANALYSING NETWORK TRAFFIC
• WHAT TO LOOK FOR IN A NETWORK TRAFFIC ANALYSIS
• NETWORK PROTOCOLS
• ARCHITECTURE DIAGRAM
• CONCLUSION
3. INTRODUCTION
• Network traffic analysis have been the most
spoken topic nowadays.
• Network traffic analysis techniques allow the
traffic at particular points on a network to be
recorded displayed in useful form and
analyzed.
• Traffic can be monitored at the network
boundary on specific segments at particular
interfaces.
• Network traffic analysis can easily be detected
using various network analyzers.
4. WHAT IS CYBER SECURITY?
•Computer security, cybersecurity or information
technology security is the protection of computer
systems and networks from information disclosure, theft
of or damage to their hardware, software, or electronic
data, as well as from the disruption or misdirection of the
services they provide.
•Cyber security is the application of technologies,
processes and controls to protect systems, networks,
programs, devices and data from cyber attacks.
•It aims to reduce the risk of cyber attacks and protect
against the unauthorised exploitation of systems,
networks and technologies.
•Cybersecurity is important because it protects all
categories of data from theft and damage.
5. WHAT IS NETWORK TRAFFIC ANALYSIS?
•Network traffic analysis (NTA) is a method of
monitoring network availability and activity to
identify anomalies, including security and
operational issues.
•Common use cases for NTA include: Collecting a
real-time and historical record of what's
happening on your network. Detecting malware
such as ransomware activity.
•Network traffic analysis is primarily done to get
in-depth insight into what type of traffic/network
packets or data is flowing through a network.
6.
7. NEED OF NETWORK TRAFFIC ANALYSIS
• Gain special knowledge about the network
• Investigate and troubleshoot abnormal behaviour
-Abnormal packets
-Network slow performance
1. congestion
2. Retransmission
-Unexpected traffic
-Broken applications
-Load balancer issues
8. • Network forensenics
-Collecting evidence
-Incident Handling
-Tracing attacks
-Linking infected hosts
-Determining patient zero
• Stealing Sensitive information
• Pen-testing
• Developing IPS/IDS signatures
• Troubleshoot problems
• Analyse the performance of network sections
to identify bottlenecks
9. • Network intrusion detection
• Logging network traffic for forsenic evidence
• Analysing the operation of network applications
• Tracing the source of DoS attack
• Detecting spyware and compromised hosts
possibly a botnet member
• To capture clear-text usernames and passwords
and those which are trivially encrypted
• To passively map a network
• To passively fingerprint the OS of network hosts
• To capture other confidential information
10. HOW TO SOLVE NETWORK TRAFFIC?
• Identify what applications/protocols are running on
the network
• Identify bandwidth hogs down to a user, application
or device level
• Monitor client to server network traffic
• Troubleshoot network & application performance
issues
11. FEATURES OF NETWORK TRAFFIC
ANALYSIS
• Broad Visibility
• Whether the network communications in question
are traditional TCP/IP style packets, virtual network traffic
crossing from a vSwitch, traffic from and within cloud
workloads, API calls to SaaS applications, or serverless
computing instances, NTA tools have the ability to monitor
and analyze a broad variety of communications in real-time.
• Encrypted Traffic Analysis
With over 70 percent of web traffic encrypted,
organizations need an accessible method for decrypting their
network traffic without disrupting data privacy implications.
NTA solutions deliver on this challenge by enabling security
professionals to uncover network threats by analyzing the full
payload without actually peeking into it.
12. • Entity Tracking
NTA products offer the ability to track and profile all
entities on a network, including the devices, users,
applications, destinations, and more. Machine learning and
analytics then attribute the behaviors and relationships to the
named entities, providing infinitely more value to
organizations than a static list of IP addresses.
• Detection and Response
Because NTA tools attribute behaviors to
entities, ample context is available for detection and response
workflows. This means security professionals no longer need
to sift through multiple data sources such as DHCP and DNS
logs, configuration management databases and directory
service infrastructure in an attempt to gain comprehensive
visibility. Instead, they can quickly detect anomalies,
decisively track them down, determine the root cause and
react accordingly.
13. • Comprehensive Baseline
To keep up with ever-changing
modern IT environments, NTA solutions track
behaviors that are unique to an entity or a small
number of entities in comparison to the bulk of
entities in an environment. The underlying data is
available immediately and NTA machine learning
baselines evolve in real-time as behaviors change.
Also, with entity tracking capabilities, NTA
baselines are even more comprehensive as they
can understand the source and destination
entities, in addition to traffic patterns. For
instance, what might be normal for a workstation
is not normal for a server or IP phone or camera.
14. NETWORK ANALYZERS
• Wireshark
• NMAP cli and gui
• Network Associates Sniffer
• TCP Dump based basic command line utility
(UNIX)
• Windows Network Monitor included with
windows server Oss
• Snort
• Dsniff
• Ettercap
15. IMPORTANCE OF NETWORK TRAFFIC
ANALYSIS
• Keeping a close eye on your network perimeter is
always good practice. Even with strong firewalls
in place, mistakes can happen and rogue traffic
could get through.
• Users could also leverage methods such as
tunneling, external anonymizers, and VPNs to get
around firewall rules.
• A network monitoring solution should be able to
detect activity indicative of ransomware attacks
via insecure protocols. Take WannaCry, for
example, where attackers actively scanned for
networks with TCP port 445 open, and then used
a vulnerability in SMBv1 to access network file
shares.
16. • Remote Desktop Protocol (RDP) is another
commonly targeted application. Make sure
you block any inbound connection attempts
on your firewall.
• Monitoring traffic inside your firewalls allows
you to validate rules, gain valuable insight,
and can also be used as a source of network
traffic-based alerts.
• Monitoring traffic inside your firewalls allows
you to validate rules, gain valuable insight,
and can also be used as a source of network
traffic-based alerts.
17. • CLI strings may reveal login procedures, presentation of user
credentials, commands to display boot or running
configuration, copying files, and more.
• Be sure to check your network data for any devices running
unencrypted management protocols, such as:
• Telnet
• Hypertext Transport Protocol (HTTP, port
80)
• Simple Network Management Protocol
(SNMP, ports 161/162)
• Cisco Smart Install (SMI port 4786)
18.
19.
20. USECASES FOR ANALYZING NETWORK
TRAFFIC
• Detection of ransomware activity
• Monitoring data exfiltration/internet activity
• Monitor access to files on file servers or MSSQL
databases
• Track a user’s activity on the network, though User
Forensics reporting
• Provide an inventory of what devices, servers and
services are running on the network
• Highlight and identity root cause of bandwidth peaks
on the network
• Provide real-time dashboards focusing on network
and user activity
• Generate network activity reports for management
and auditors for any time period
21. WHAT TO LOOK FOR IN A NETWORK
TRAFFIC ANALYSIS
• Not all tools for monitoring network traffic are
the same. Generally, they can be broken down
into two types: flow-based tools and deep
packet inspection (DPI) tools.
• Within these tools you’ll have options for
software agents, storing historical data, and
intrusion detection systems.
• When evaluating which solution is right for
your organization, consider these five things:
22. 1. Availability of flow-enabled devices
2. The data source
3. The points on the network
4. Real-time data vs. historical data
5. Full packet capture, cost and complexity
28. CONCLUSION
• Network traffic analysis is an essential way to monitor
network availability and activity to identify anomalies,
maximize performance, and keep an eye out for
attacks.
• Alongside log aggregation, UEBA, and endpoint data,
network traffic is a core piece of the comprehensive
visibility and security analysis to discover threats early
and extinguish them fast.
• When choosing a NTA solution, consider the current
blind spots on your network, the data sources you
need information from, and the critical points on the
network where they converge for efficient monitoring.
With NTA added as a layer to your security information
and event management (SIEM) solution, you’ll gain
visibility into even more of your environment and your
users.
29. FUTURE SCOPE
• This can be further enhanced to
• Fault management
• Alerts and Threshold
• Windows event log monitoring
• Traffic management
• Network Security
• Network scheduling