Flow Collection and Analytics Dennis Marti January 11, 2017

Disclaimer The views and opinions expressed in this presentation are those of the author and do not necessarily reflect the official policy or position of Verizon. Reference to any product, commercial, free or open source, does not constitute endorsement or recommendation by Verizon.

Network Security Data Capabilities have Evolved Over Time Background Capabilities have Evolved Over Time Initially based on a handful of network security sensors. Three full-time analysts Part of “Network Abuse” function Since 2011 Number of network security data collection points has grown. Coverage includes multiple geographic areas including international. Collect and process a broader variety of netflow data elements Twelve analysts with dedicated management Faster, more flexible on-boarding of data Dedicated, fault-tolerant, managed environment Function provides a variety of internal support Analytics platform Ad hoc research/response capability

Infrastructure Overview

Data Collection and Preparation

Netflow Processing Extract, transform, load Incoming flow files are written every minute by load- balanced collectors. Routine tasks are triggered by the file transfer event that moves data from the collection tier to storage. Netflow processing includes: Monitoring internal devices and edge routers for malicious addresses. Matching flows are decorated with geographic and network information then loaded into Splunk for additional analysis. Aggregating flows to support network operations and engineering applications. Filtering managed services flow data and join with geographic and IOC data. Load into Splunk for MSS analysis and reporting. Writing to Kafka for anomaly detection. Creating Bloom filters to speed up forensic searches. Counting ports, protocols, bytes, packets, flows, etc.

Enhancing Netflow for Analysis Data fusion Single pane of glass Almost all incoming data is indexed into Splunk. Netflow is an exception due to its volume, but we index a lot of it based on watch list matches. Since firewall, DNS, SNMP, and IDS events reside in Splunk, alerts and reports trigger additional actions like loading relevant netflow. Aggregating flows End points are typically aggregated prior to indexing. Aggregate data is often summarized and indexed a second time to speed up searching and dashboards. Network and customer information Netflow collected for indexing is enhanced with network, customer and geographic information.

Peering Traffic Analysis 15 minute ingress traffic by peer

Netflow Search

Incident Response Recent success stories By observing the ports used across flows, we were able to establish that an address was being used as an SMTP server. This behavior tied it to the delivery of phishing emails and Vawtrack malware. Netflow data was used to analyze the changing exploit kit landscape by tracking the distinct flows from a set of malicious landing pages.  This analysis was met with great reception from our customers given the impact these kits have on their environments Allowed us to reevaluate a recent rise in shellshock activity that was initially reported by another organization. Using flow data increased the estimation of targeted systems 8x, bringing to light a massive campaign