An incident analysis system NICTER and its analysis engines based on data mining techniques

摘要: Malwares are spread all over cyberspace and often lead to serious security incidents. To grasp the present trends of malware activities, there a number ongoing network monitoring projects that collect large amount data such as traffic IDS logs. These need be analyzed in depth since they potentially contain critical symptoms, an outbreak new malware, stealthy activity botnet type attack on unknown vulnerability, etc. We have been developing Network Incident analysis Center for Tactical Emergency Response (NICTER), which monitors wide range networks real-time. The NICTER deploys several engines taking advantage mining techniques order analyze monitored traffics. This paper describes brief overview NICTER, its based engines, Change Point Detector (CPD), Self-Organizing Map analyzer (SOM analyzer) Forecast engine (IF).