Topological analysis and visualisation of network monitoring data: Darknet case study

摘要: Network monitoring is a primordial source of data in cyber-security since it may reveal abnormal behaviors users or applications. Indeed, security analysts and tools like IDS (Intrusion Detection system) SIEM (security information event management) rely on them as single combined with others. In this paper, we propose visualisation method derived from the Mapper algorithm that has been developed field Topological Data Analysis (TDA). The its associated tool are able to analyze large number IP packets order make malicious activities patterns easily observable by analysts. We applied our darknet data, i.e. an entire supposed not used subnetwork Internet have found those missed Suricata, widely State-of-the-Art IDS.