Proceedings of ISP RAS


Methods of presenting the results of network traffic analysis

A. I. Get'man (ISP RAS, Moscow, Russia)
Yu. V. Markin (ISP RAS, Moscow, Russia)
D. O. Obydenkov (ISP RAS, Moscow, Russia)
V. A. Padaryan (ISP RAS, Moscow, Russia, MSU, Moscow, Russia)
A. Yu. Tikhonov (ISP RAS, Moscow, Russia)

Abstract

The article proposes different methods of presenting network traffic analysis results, the need for which arises primarily in the area of network security. One of the most important tasks is to identify malicious traffic. For this purpose both the complete graph of network interactions and time-based packet diagram are presented. These components are used during investigation of information security violation incidents. The timing diagram is also used in analysis of tunneling protocols because it allows the analyst to determine which protocol headers are necessary to visualize. For tasks associated with reverse engineering and debugging of network protocols, it is proposed to use a journal which records protocol header parsing errors. Presented graphic components either have no analogues among the opensource tools or improve on existing opensource solutions.

Keywords

network traffic analysis, network protocols debugging, graph of network interactions, visualization, error log

Edition

Proceedings of the Institute for System Programming, vol. 28, issue 6, 2016, pp. 103-110.

ISSN 2220-6426 (Online), ISSN 2079-8156 (Print).

DOI: 10.15514/ISPRAS-2016-28(6)-7

Full text of the paper in pdf (in Russian) Back to the contents of the volume