Graph-based analysis in network security

摘要

Traffic graph analysis has become an increasingly useful tool in network security. By summarizing the aggregate activity of a particular service or network using graph based representations, it is possible to model normal activity using a variety of different attributes which are not easily identified or exploited by attackers. In this paper, we discuss several examples of analysis using traffic graphs and demonstrate its potential for scan detection, identifying hitlist attackers, and identifying spammers.