Learn how to use data science to conduct a network forensics investigation. Jungwoo explains how you can leverage various data science tools to enhance the effectiveness of your network forensics investigations.
- [Instructor] Network forensics in its conventional form is not scalable enough to deal with the explosive growth of data. Think about combing though gigabytes or terabytes of network data using a popular tool like Wireshark. Doing this is simply infeasible and too time-consuming. The traditional tools may also crash and burn very quickly in such a scenario. Because of these limitations, more scalable network forensic solutions are emerging rapidly. For example, companies like Endace offer network recorders capable of capturing 100 percent of network traffic with their 192 terabytes of local storage.
RSA Netwitness uses big data analytics to help investigate suspicious network activities. What's special about this product is its ability to leverage machine learning to predict the level of risks associated with a specific network security drag, which is useful for prioritization. Blue Coat is another leading company providing abilities to record, replay and analyze network traffic as part of incident response and forensics efforts.
Threat intelligence shared between vendors and their customers is also making these products more powerful by making it possible to more easily find the evidence of interest and trace it back to the cybercriminals who caused an incident. With the new capabilities of these more data-driven network forensics solutions, network forensics investigations are becoming more effective and less labor intensive. It is definitely a positive development for the cyber forensics investigators in the trenches today.
- Network security concepts
- The basic functions of a firewall
- Intrusion detection and prevention systems
- Using network data to improve security
- Using log servers to collect data
- Collecting application data
- Collecting OS data
- Network forensics
- Network security visualization