What is Network Traffic Analysis?

Introduction

Network traffic analysis is the process of analyzing network traffic with the help of machine learning and rule-based algorithms. I know this definition isn’t very helpful, so let me elaborate on the idea of NTA (network traffic analysis).

Let's say you’re working on a task within your company's network when some hacker or someone unknown tries to access your network or tries to install some malware onto your system. What would happen? You would probably not know about it right away because you don’t constantly watch the network for suspicious activity. This is where NTA helps: It monitors the network constantly. If it finds suspicious activity or a security threat, it tries to resolve the smaller issues. If it finds more serious vulnerabilities, it alerts the IT team.

Other network security tools also exist, like firewalls, intrusion prevention systems (IPS), and intrusion detection systems (IDS). These tools secure your network within its perimeter from traffic that tries to trespass the network without permission. In contrast, NTA secures the network from from both within-parameter threats and outside traffic threats from the cloud, virtual switches, and traditional TCP/IP packets.

In modern days, along with traditional algorithms, NTA has machine learning solutions embedded. Machine learning algorithms, such as time series analysis, analyze the general behavior of the network. If the algorithms find any abnormal activity, the NTA tools notify the network team about it. There are several benefits of using NTA:

• Provides analytics services
• Monitors IoT devices that generate and send a lot of data across the network
• Troubleshoots different security issues
• Enhances end-to-end cloud visibility

In this article, you’ll learn about NTA, its importance, and its strengths and weaknesses.

Importance of Network Traffic Analysis

NTA solutions keep track of each and every device connected to your network. They keep an eye on who’s using the network and when. When cloud computing became a thing, visibility of the network became hard. Multiple devices on a network share data via the cloud or IoT devices. Hackers or any unknown person can enter a network using different tactics; with technological advancement, hackers are constantly training themselves to crack every possible security feature.

When we think about security, firewalls can tackle most of the threats that occur when installing software or exchanging files on a network, but there may be some rough traffic that even a firewall cannot stop. For example, ransomware could seem like a piece of software and pass through a firewall. Sometimes network users may use different mechanisms, like VPN, to get around a firewall and that can cause some security issues. NTAs can tackle ransomware and other security threats that pass through the firewall.

Machine learning algorithms used for NTA can detect security threats even if they’re encrypted. And that’s not all. Along with analyzing threats in the network, NTA also helps monitor resource utilization and helps IT teams manage resources accordingly. In cases where a network doesn’t utilize a resource for a long time, the NTA solution tells the IT team to decommission it. This saves the cost of that extra resource. Finally, NTA also provides insights about the uptime and downtime of the network. Some vulnerabilities may cause network downtime, and an NTA tool will notify the network team so they can inspect anomalies and resolve the issues.

Strengths of NTA

Now that you’re aware of NTA and why it is important for any organization that uses a network, let’s focus on the strengths and weaknesses of NTA. Let's first start with identifying the strengths.

• Built-in predictive analytics: You’ve already learned that NTA makes use of different machine learning algorithms, like time series analysis, to identify suspicious activity on a network. This process of analysis starts with storing data about the network, then training machine learning algorithms on that data, and finally using the data to make run-time predictions about the traffic that passes through the network.
• Extensive visibility: I believe broad visibility is the biggest strength of NTA solutions. They monitor traffic coming from almost all sources, like TCP/IP packets, connected IoT devices, switches, and API calls.
• Speed: NTA solutions investigate security threats faster than any other network monitoring tool. They not only identify the threat, they also respond to the threats appropriately either by blocking unknown entities or notifying the network security team.
• Encrypted traffic analysis: Organizations require an easy-to-use technique for decrypting network traffic without jeopardizing data privacy. NTA systems meet this requirement. They evaluate the entire payload so security professionals know about the network risks without having to look at the network themselves.
• Resource monitoring: Along with monitoring security threats, NTA keeps notes on resource utilization. This helps IT teams manage resources accordingly. If any resource sits idle for a long time, they can remove or adjust.

Weaknesses of NTA

Since you are IT professionals, you might know that each and every technology has its dark side. NTA also has some weaknesses and disadvantages.

• Data storage: Analysis of network traffic relies on historic data. Obviously, you need some data to train time series models, which you can then use to identify unknown objects and fluctuations in the network. You need an ample amount of data to train the machine learning algorithms. Most of the NTA tools do not store older data and as time goes on, they store only the most recent data. Due to this flaw, NTA tools can sometimes fail to identify issues. Machine learning models are iteratively trained on older data and if older data is not available, there's a chance that algorithms will be poorly trained. This can cause NTA solutions to miss certain issues.
• Data handling: In a network, data moves in different forms, namely packet data and flow data. These types of data movement come from different sources. Most NTA solutions don’t handle both types of data. This makes the network more prone to security threats because hackers can get into your network using either type of data movement.
• Cost and complexity: NTA solutions retain data in packets. Because of this, organizations need to purchase devices like load balancers, packet-filtering firewalls, and storage devices, which increase an organization’s costs. Also, they are complex to manage so they take some expertise to operate.
• Security: Although NTA solutions secure your network, they are made by many different companies. Organizations must have a great amount of trust in the companies providing these solutions. If the company is worthy of trust, there’s no reason to worry, but if it’s not, this brings security issues to your network.

Conclusion

Now that you know a bit about the strengths and weaknesses of NTA, let me tell you this is just a very short explanation. To truly know about NTA, and more about its importance, strengths, and weaknesses, you must read The Price of Hubris. This book ensures that you won’t have to visit any other resource to learn about NTA. It explains more about how hackers exploit NTAs’ shortcomings. Happy reading!

After reading this article, you now know a bit about network traffic analysis, its importance in securing networks, and its different strengths and weaknesses. A network is a combination of different entities connected together with data flowing in different forms. Traditional security mechanisms, like firewalls and intrusion detection systems, help secure within the perimeter of a network. But it’s hard for those solutions to identify the security threats coming from cloud components, IoT components, and externally connected components. NTA solutions solve this problem by analyzing these sources as well.

This post was written by Gourav Singh Bais. Gourav is an applied machine learning engineer skilled in computer vision/deep learning pipeline development, creating machine learning models, retraining systems, and transforming data science prototypes to production-grade solutions.