10th EAI International Conference on Mobile Multimedia Communications

Research Article

Enhancing Enterprise Security through Cost-effective and Highly Customizable Network Monitoring

Download48 downloads
  • @INPROCEEDINGS{10.4108/eai.13-7-2017.2270274,
        author={Joshua Regenold and Kai Wang and Gary Smith and Qingzhong Liu and Lei Chen},
        title={Enhancing Enterprise Security through Cost-effective and Highly Customizable Network Monitoring},
        proceedings={10th EAI International Conference on Mobile Multimedia Communications},
        publisher={EAI},
        proceedings_a={MOBIMEDIA},
        year={2017},
        month={12},
        keywords={data security network traffic analysis traffic logging l2 and l3 analysis},
        doi={10.4108/eai.13-7-2017.2270274}
    }
    
  • Joshua Regenold
    Kai Wang
    Gary Smith
    Qingzhong Liu
    Lei Chen
    Year: 2017
    Enhancing Enterprise Security through Cost-effective and Highly Customizable Network Monitoring
    MOBIMEDIA
    EAI
    DOI: 10.4108/eai.13-7-2017.2270274
Joshua Regenold1, Kai Wang2, Gary Smith1, Qingzhong Liu1,*, Lei Chen2
  • 1: Sam Houston State University
  • 2: Georgia Southern University
*Contact email: liu@shsu.edu

Abstract

Network monitoring and network traffic analysis software are common tools used in an enterprise, giving IT administrators valuable insight into the status of their servers and network devices. Limited research has been done to highlight the security benefits of low-level network traffic logging and analysis, though much of it involves testing the network activity of malicious software in lab environments, using cost-prohibitive software to analyze traffic for a pre-determined amount of time. This is a useful way to isolate network activity to only the malicious software, but it also eliminates valuable baseline traffic information for an enterprise network. There are significant security benefits to be gained from analyzing how malware reacts in – or alters – an enterprise network. This paper provides techniques for getting a baseline of enterprise network traffic and analyzes how different types of malware can affect this baseline. Using only low- and no-cost software and services, we analyze the storage requirements for historical network traffic data and present techniques to filter out much of the noise, significantly reducing the amount of data that must be stored and analyzed. The results of our technique are compared against traditional antimalware and network traffic analysis methods, revealing our approach to be a cost-effective, highly customizable and effective layer of a complete defense-in-depth security strategy.