基于数据分析的网络安全(影印版第2版)(英文版)

传统入侵检测和日志分析已不足以保护当今的复 杂网络。迈克尔·柯林斯著的《基于数据分析的网络 安全》这本实用指南的第2版中，安全研究员Michael Collins向信息安全人员展示了最新的网络流量数据 收集分析技术和工具。你将会理解网络如何被使用以 及哪些行动是加固和防护系统所必需的。 本书通过3个部分检视了收集和组织数据的过程 、多种分析工具以及各种分析场景和技术。新章节关 注活跃监控和流量处理、内部威胁检测、数据挖掘、 回归与机器学习，还有其他主题。

Preface Part Ⅰ. Data 1. Organizing Data: Vantage, Domain, Action, and Validity Domain Vantage Choosing Vantage Actions: What a Sensor Does with Data Validity and Action Internal Validity External Validity Construct Validity Statistical Validity Attacker and Attack Issues Further Reading 2. Vantage: Understanding Sensor Placement in Networks The Basics of Network Layering Network Layers and Vantage Network Layers and Addressing MAC Addresses IPv4 Format and Addresses IPv6 Format and Addresses Validity Challenges from Middlebox Network Data Further Reading 3. Sensors in the Network Domain Packet and Frame Formats Rolling Buffers Limiting the Data Captured from Each Packet Filtering Specific Types of Packets What If It''s Not Ethernet? NetFlow NetFlow v5 Formats and Fields NetFlow Generation and Collection Data Collection via IDS Classifying IDSs IDS as Classifier Improving IDS Performance Enhancing IDS Detection Configuring Snort Enhancing IDS Response Prefetching Data Middlebox Logs and Their Impact VPN Logs Proxy Logs NAT Logs Further Reading 4. Data in the Service Domain What and Why Logfiles as the Basis for Service Data Accessing and Manipulating Logfiles The Contents of Logfiles