{"id":1469,"date":"2009-02-05T15:19:22","date_gmt":"2009-02-05T15:19:22","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=1469"},"modified":"2015-09-09T19:39:03","modified_gmt":"2015-09-09T11:39:03","slug":"flowmatrix-free-network-behavior-analysis-system","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2009\/02\/flowmatrix-free-network-behavior-analysis-system\/","title":{"rendered":"FlowMatrix – Free Network Behavior Analysis System"},"content":{"rendered":"

[ad]<\/p>\n

FlowMatrix is Network Anomaly Detection and Network Behavioral Analysis (NBA) System, which in fully automatic mode constantly monitors your network using NetFlow records from your routers and other network devices in order to identify relevant anomalous security and network events.<\/p>\n

In addition, the new release of FlowMatrix, (ver.0.9.62 and later) supports Network Applications Behavior Analysis. This means you can define 3 groups of applications to monitor and FlowMatrix will automatically create a baseline for each of them, just like it does for network. When the baseline is crossed a security event is triggered. This allows you to catch many attacks, exploits and other security violations on more granular level giving you even better visibility to your network and network applications environment.<\/p>\n

After initial learning period of (7-14 days) FlowMatrix builds multidimensional behavioral models of your network and network applications and later uses them to detect relevant anomalous security and network events. FlowMatrix provides short response time of 1 minute so you will know about anomaly right when it begins to happen.<\/p>\n

How it works<\/strong><\/p>\n

The FlowMatrix receives NetFlow records from routers or other network devices you configure to send NetFlow to FlowMatrix. It processes NetFlow records and after learning period of 7-14 days builds detailed multidimensional behavioral models of your network. Later it compares measured parameters from incoming NetFlow records to built models and identifies relevant anomalous events which significantly deviate from what is expected by the models and logs an event.<\/p>\n

To help you identify what each logged event means FlowMatrix performs (when possible) classification of each event to corresponding class of attack or network events.<\/p>\n

In order to provide relevant possible information about each logged event FlowMatrix logs relevant filtered detailed information which can be used for more detailed investigation of the event.<\/p>\n

Features<\/strong><\/p>\n