RICH METADATA-BASED NETWORK SECURITY MONITORING AND ANALYSIS

摘要

Network security monitoring for external threats is provided that is based on rich metadata collected from internal network traffic that is analyzed for anomalies against a behavior baseline to detect the external threats. Rich metadata includes but is not limited to the information typically found in the headers of every layer of telecommunication protocols describing the communication between network entities.

主权项

1. A method for monitoring a computer network for external threats comprising:
employing a data processing application element on a processing apparatus with nonvolatile storage and a DNS server for:
tapping into network traffic at critical points of an internal data network;providing direct links to bring tapped traffic to metadata probes;causing the metadata probes to automatically extract rich metadata of traffic flow, the rich metadata being at least information found in headers of every layer of protocols associated with digital communication and describing communication between network entities;aggregating the extracted metadata into a data cluster; andproviding an insight report on the data cluster to an output element for use by security analysts for analyzing dataflow for the external threats.