内容提要 传统入侵检测和日志分析已不足以保护当今的复杂网络。这本实用指南更新的第二版中,安全研究员Michael Collins向信息安全人员展示了近期新的网络流量数据收集分析技术和工具。你将会理解网络如何使用,以及哪些行动是加固和防护系统所必需的。本书通过三个部分检视了收集和组织数据的过程,多种分析工具,以及各种分析场景和技术。新章节关注活跃监控和流量处理、内部威胁检测、数据挖掘、回归与机器学习,还有其它话题。 目录 PrefacePart Ⅰ. Data1. Organizing Data: Vantage, Domain, Action, and ValidityDomainVantageChoosing VantageActions: What a Sensor Does with DataValidity and ActionInternal ValidityExternal ValidityConstruct ValidityStatistical ValidityAttacker and Attack IssuesFurther Reading2. Vantage: Understanding Sensor Placement in NetworksThe Basics of Network LayeringNetwork Layers and VantageNetwork Layers and AddressingMAC AddressesIPv4 Format and AddressesIPv6 Format and AddressesValidity Challenges from Middlebox Network DataFurther Reading3. Sensors in the Network DomainPacket and Frame FormatsRolling BuffersLimiting the Data Captured from Each PacketFiltering Specific Types of PacketsWhat If Its Not Ethernet?NetFlowNetFlow v5 Formats and FieldsNetFlow Generation and CollectionData Collection via IDSClassifying IDSsIDS as ClassifierImproving IDS PerformanceEnhancing IDS DetectionConfiguring SnortEnhancing IDS ResponsePrefetching DataMiddlebox Logs and Their ImpactVPN LogsProxy LogsNAT LogsFurther Reading4. Data in the Service DomainWhat and WhyLogfiles as the Basis for Service DataAccessing and Manipulating LogfilesThe Contents of Logfiles…… 作者介绍 Michael Collins是位于华盛顿的网络安全与数据分析公司RedJack有限责任公司的首席科学家。他主要关注于网络设备和流量分析,特别是大规模流量数据集的分析。 序言
以下为对购买帮助不大的评价