Cybersecurity Analytics - Module 05 - Hunting Cyber Threats In Encrypted Traffic

This podcast provides a comprehensive network traffic data analysis using real-world traces. The research utilizes various open-source tools like tcpdump, tcptrace, and CoralReef alongside Matlab to examine traffic at the packet, flow, and connection levels. Key areas of investigation include protocol distribution, packet lengths, TCP retransmissions, and round-trip times. The author identifies significant patterns, such as the heavy-tailed nature of flow sizes and the prevalence of Zipf-type distributions in network traffic. Ultimately, the podcast described framework for network analysts to improve traffic engineering and resource optimization.