Angela Horneman

## Overview Angela Horneman, a research analyst from the CERT division at Carnegie Mellon University's Software Engineering Institute, presents a comprehensive workshop on identifying and filtering network noise to improve security event detection. The talk focuses on practical methods for using network flow data to distinguish legitimate traffic (noise) from potential security events, emphasizing the importance of precise definitions in cybersecurity analysis.

## Key Topics **Security Events and Event Hunting:** Horneman defines a security event as a series of actions across multiple assets where at least one action adversely impacts organizational assets. She uses an SSH brute force attempt as a concrete example, breaking it down into individual actions (remote communication, router forwarding, firewall processing, server response) that occur across network infrastructure. Event hunting is described as a four-step process: identifying events to hunt, defining those events based on observable actions, enumerating individual actions and their locations in network infrastructure, and considering legitimate causes for each action.

**Defining Events and Noise:** The speaker introduces a framework for defining both events and noise using three dimensions: Description (attributes), Deviation (measurement-based changes), and Disrepute (identity/reputation). This matrix approach applies to both known and unknown event types. The importance of precise definitions is emphasized repeatedly, as definitions determine where analysts look and what they can find.

**Network Flow Fundamentals:** The workshop assumes basic network flow fields: source/destination IPs, source/destination ports, protocols, packet/byte counts, time stamps, and TCP flags. The distinction between unidirectional and bidirectional flow is explained, with unidirectional flow preferred for security analysis as it allows detection of asymmetrical routing patterns. Unsampled network flow is strongly recommended over sampled flow, with real-world examples showing that sampled data misses the majority of actual events.

## Technical Details **Scanning Identification:** The group collaboratively defines port scanning (specifically on port 22) as: a single external IP address targeting five or more internal IP addresses on the same destination port. More generic scanning can be defined as an external IP attempting connections to 1,000+ addresses, though this increases false positives. Network scanning (multiple destinations) and port scanning (multiple ports on single destination) are distinguished as separate but related noise types.

**Backscatter Analysis:** Backscatter results from DDoS attacks or spam targeting outside organizations using spoofed internal IPs. Key characteristics include: initial TCP flag of ACK (not SYN), incoming flows without corresponding outgoing SYN flows, more than header-size bytes, short duration, likely targeting both active and inactive IP space, and protocols limited to TCP/UDP (not ICMP). Backscatter from DDoS typically shows the same source IP across multiple flows, while spam-related backscatter has varying sources per flow.

**Common Traffic Filtering:** DNS traffic can constitute 50% or more of network volume. Legitimate DNS requests can be profiled statistically for byte ranges and packet counts, then filtered by destination port 53, UDP/TCP protocols, and expected flag behavior. The speaker recommends identifying internal DNS servers versus external DNS usage as an indicator of potential compromise. Additional common noise sources include CDN traffic (Netflix, Google Apps), country-based filtering, web traffic, and network proxy traffic. Proxy identification can be achieved by applying scanning analytics and filtering for IPs with high content throughput.

## Takeaways - **Precision matters:** More detailed definitions reduce false positives but require deeper analysis; generic definitions are faster but noisier. - **Layered filtering:** Scanning and backscatter together often represent 10-20%+ of network flow data; filtering these significantly reduces analysis burden. - **Profiling is essential:** Statistical profiling of normal behavior (especially for DNS, client/server patterns) provides a foundation for noise definition. - **External context helps:** Sites tracking active DDoS attacks and geolocation data can augment noise definitions. - **Manual review remains necessary:** Even with well-defined analytics, analysts typically need to manually investigate remaining data to find genuine security events. - **Tools and pipelines:** SiLK, Bro, Argus, and Flow Tools are mentioned as practical implementations for applying network flow analytics.