Untitled Presentation

It helps identify unauthorized access and potential threats.

It slows down network performance.

It is only useful for small organizations.

It replaces the need for firewalls.

Wazuh

Nagios

Solarwinds

Elastic

Attempted Break-ins

Masquerade attacks

Running permitted programs

Denial of Service

Because firewalls cannot detect all threats

Because firewalls are always secure

Because firewalls can inspect all traffic

Because firewalls never get attacked

To block all network traffic

To inspect all network activity and identify suspicious patterns

To encrypt data transmissions

To manage user authentication

Monitoring target system activity

Reporting information to security infrastructure

Responding to detected intrusions

Encrypting network traffic

Swatch

Log check

Mod_security

Tripwire

Alerts – Visual, Audio, E-mail, Pager, SNMP Alarms

Snapshots taken for later analysis

Update Policy

Block Traffic Completely

The protocol to use

The value of a payload

The port number

The message to send

Preprocessing and splitting data into training and testing sets

Classification using SVM

Testing the trained model

Labeling the data

Smurf ICMP echo request flooding

UDPStorm spoofed request flooding

Checksum errors in packets

Normal TCP/IP communication

Protect; Firewall

Detect/Monitoring; IDS/IPS, SIEM

Respond; Network Forensics

Predict; Threat Intelligence