Network modeling detects anomalies

摘要

As network attacks become increasingly sophisticated and frequent, it has become nearly impossible for security administrators to keep pace with every exploit, worm, virus and denial-of-service attack. To address this issue, new relational network-modeling systems detect security threats by recognizing when network traffic patterns vary from the norm. Implemented through software, relational network modeling analyzes the role of systems on a network, examining all inter-host relationships and communications. Collection devices placed in the network monitor traffic directly either by capturing raw packets or from flow exports built by routers and switches.