US-CERT: Netflow Visualization

This presentation was given at FloCon 2012, held in Austin, Texas, from January 9 to 12, 2012. At FloCon 2012, participants focused on the progression of analytics from ideas to prototypes to tools. Since each phase has its own set of successes and raises its own set of challenges, organizers encouraged submissions and discussions across the spectrum. Participants addressed topics such as identifying which incident case studies spark the seed of a new idea, discussed how flow data can help refine a static signature, identified the costs and benefits of implementing a technique at the large-scale network level versus host level, and discussed how well new flow-based analytical tools integrate into an analyst's workflow.