Detection of network embedded devices in the perimeter of the organization

Abstract

One of the important tasks in ensuring the information security of a corporate network is to ensure the smooth operation of its main components, especially during peak loads. The development of network infrastructure is inevitably associated with the emergence of processes in the network that reduce network performance. One of the most difficult tasks in the administration of large corporate networks is tracking parasitic traffic generated by computer viruses, various scanners and software. Cyber groups are overcoming the protection on the perimeter of the organizations they are interested in, and this is evidenced by the trend towards an increase in the proportion of successful targeted attacks. This is an occasion to shift the focus from preventing attacks on the perimeter to timely detection of compromise and response within the network. However, it is difficult to identify a carefully planned, sometimes time-spaced cyberattack. Nevertheless, the actions of hackers leave traces in network traffic, which means that the task of a cybersecurity specialist is to detect these traces. This article will consider one of the possible options for identifying atypical network activity and detecting the end device that generates these events.