SYSTEM SECURITY MONITORING

摘要

A computing device may receive netflow data that includes information corresponding to network-side activity associated with a target device. The computing device may evaluate the netflow data based on a netflow signature to identify potentially malicious activity. The netflow signature may include information corresponding to two or more network events occurring in a particular order. The computing device may report, to another computing device, that potentially malicious activity, corresponding to the network data, has been detected based on the evaluation of the netflow data.