OF PRESENTING THE RESULTS OF NETWORK TRAFFIC ANALYSIS

Abstract

The article proposes different methods of presenting network traffic analysis results, the need for which arises primarily in the area of network security. One of the most important tasks is to identify malicious traffic. For this purpose both the complete graph of network interactions and time-based packet diagram are presented. These components are used during investigation of information security violation incidents. The timing diagram is also used in analysis of tunneling protocols because it allows the analyst to determine which protocol headers are necessary to visualize. For tasks associated with reverse engineering and debugging of network protocols, it is proposed to use a journal which records protocol header parsing errors. Presented graphic components either have no analogues among the opensource tools or improve on existing opensource solutions.

Keywords

• анализ сетевого трафика
• отладка сетевых протоколов
• граф сетевых взаимодействий
• визуализация
• журнал ошибок разбора