CyberCode Academy

Course 13 - Network Forensics | Episode 4: Log Analysis, SIM Correlation, and Network Attack Signature Detection

Listen Later
In this lesson, you’ll learn about:
  • Log analysis fundamentals and why logging is essential for security visibility
  • SIM (Security Information and Event Management) correlation and event analysis
  • Network attack signature detection using tools such as Snort and packet capture analysis
1. Introduction to Logging and Security Visibility Effective security monitoring depends on logging the right information and establishing baselines for normal behavior. A common challenge is that security tools—especially IDS sensors—produce many false positives, which can lead analysts to ignore real threats (as seen in major breaches such as Home Depot). 2. Logging Strategy and Log Integrity Logging Strategy Essentials Organizations must implement:
  • A clear logging strategy
  • Structured and normalized log data
  • Centralized logging
  • Real-time and continuous monitoring
  • Long-term storage for historical correlation
What Must Be Logged
  • Unsuccessful authentication attempts
    • Example: 100 → 10,000 attempts indicates brute-force or dictionary attacks
  • Successful authentication attempts
    • Example: 1,000 → 20,000 successful logins indicates compromised credentials being reused
Maintaining Log Integrity Logs must be treated like financial ledgers:
  • Log storage must be read-only
  • Use hashing to ensure logs are not modified
  • Use encryption to protect confidentiality
  • Large storage capacity is required to retain logs for long-term, low-and-slow attack correlation
  • Syslog is the most common centralized log transport and storage method
3. SIM (Security Information and Event Management) Correlation What SIMs Do SIM systems do not store logs; they:
  • Collect and centralize logs from many devices (nodes, routers, switches, appliances)
  • Correlate and analyze events
  • Provide near real-time security violation alerts
  • Reveal attack patterns that individual log sources might not show
Log Sources for SIM Analysis SIMs typically gather logs from:
  • Files (data logs)
  • Operating Systems
  • Network traffic
  • Applications
Audit Reduction Tools Because audit logs can be massive, tools are used to:
  • Eliminate unnecessary data
  • Focus analysts on events of significance
4. Network Attack Signature Detection Signature detection identifies patterns that indicate malicious activity. Tools such as Snort and packet capture analysis are commonly used. Types of Signatures A. Standard Communication Signatures
  • ICMP ping has a predictable payload (A B C D …)
  • TCP three-way handshake (SYN, SYN-ACK, ACK) helps identify typical connections such as FTP (21) or Telnet (23)
B. Reconnaissance Scans
  1. Ping Sweeps
    • Echo requests sent to incrementing IP addresses
  2. Port Scans
    • One source IP sending SYN packets to many ports on one host
    • Modern scanners use non-sequential methods
  3. Stealth Scans (used to evade detection)
    • ACK scans
    • SYN stealth scans
    • FIN scans (only FIN flag)
    • NULL scans (no flags)
  4. Christmas (Xmas) Scans
    • Flags typically set: FIN, URG, PUSH
    • Snort distinguishes traditional Xmas scans from tools like Nmap (which uses only FUP flags)
C. Denial of Service (DoS) Attacks
  • Ping of Death – oversized ICMP packets
  • SYN Flood – large numbers of half-open TCP connections exhausting port capacity
D. Trojans and Backdoors
  • Identified by traffic on known Trojan ports
    • Example:
      • Netbus → port 12345
      • Back Orifice → port 31337
5. The Objective of Correlation and Detection The primary goal is to:
  • Detect attack patterns before they complete
  • Combine behavior-based insight with signature-based detection
  • Continuously update rules and detection logic as threats evolve
Tools like Snort rely on constantly updated rule sets to stay effective against modern attacks.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
...more
View all episodesView all episodes
Download on the App Store
CyberCode AcademyBy CyberCode Academy