FlowMatrix – Free Network Behavior Analysis System

Use Netsparker


FlowMatrix is Network Anomaly Detection and Network Behavioral Analysis (NBA) System, which in fully automatic mode constantly monitors your network using NetFlow records from your routers and other network devices in order to identify relevant anomalous security and network events.

In addition, the new release of FlowMatrix, (ver.0.9.62 and later) supports Network Applications Behavior Analysis. This means you can define 3 groups of applications to monitor and FlowMatrix will automatically create a baseline for each of them, just like it does for network. When the baseline is crossed a security event is triggered. This allows you to catch many attacks, exploits and other security violations on more granular level giving you even better visibility to your network and network applications environment.

After initial learning period of (7-14 days) FlowMatrix builds multidimensional behavioral models of your network and network applications and later uses them to detect relevant anomalous security and network events. FlowMatrix provides short response time of 1 minute so you will know about anomaly right when it begins to happen.

How it works

The FlowMatrix receives NetFlow records from routers or other network devices you configure to send NetFlow to FlowMatrix. It processes NetFlow records and after learning period of 7-14 days builds detailed multidimensional behavioral models of your network. Later it compares measured parameters from incoming NetFlow records to built models and identifies relevant anomalous events which significantly deviate from what is expected by the models and logs an event.

To help you identify what each logged event means FlowMatrix performs (when possible) classification of each event to corresponding class of attack or network events.

In order to provide relevant possible information about each logged event FlowMatrix logs relevant filtered detailed information which can be used for more detailed investigation of the event.

Features

  • Performs continuous 27×7 fully automatic behavioral analysis of your network traffic to identify relevant anomaly security and network events.
  • Performs continuous 27×7 fully automatic behavioral analysis of your 3 groups of network applications traffic to identify relevant anomaly security and network events.
  • Classifies each reported anomaly event (when possible) as belonging to proper class of security or network events (DDoS, Scans, Alpha flows, network outages etc.).
  • Collects and presents relevant detailed information for each anomalous event so you can drill down to investigate each reported event to decide on proper set of actions.
  • Utilizes NetFlow records collected by network devices such as routers and switches. This eliminates need for additional expensive network probes and as result substantially lowers price for building network security monitoring solution. Currently only NetFlow versions 1, 5, 7 are supported, more being added;
  • Provides short response time — 1 minute, so you will know about events as they begin to happen.
  • Builds multidimensional behavioral models of your network and network applications in order to lower false positive rate.
  • Provides rule system for more interactive event identification so you can create rules to monitor for conditions you would like to know about (for example show host contacted by more then 100 unique hosts, show host that contacted more then 60 unique hosts etc.).

You can download FlowMatrix here:

FlowMatrix v0.9.75 (I’d grab it now if you can, I have a feeling it won’t be free forever)

Or read more here.

Posted in: Countermeasures, Networking Hacking, Security Software


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


One Response to FlowMatrix – Free Network Behavior Analysis System

  1. lars February 5, 2009 at 9:33 pm #

    wow, continous 27×7 monitoring! That should match the working hours of most admins :D