Network Security Analysis คืออะไร
Network Security Analysis = กระบวนการ สังเกต, ตรวจจับ, วิเคราะห์, และตอบสนอง ต่อภัยคุกคามและช่องโหว่ในเครือข่าย ผ่านการรวบรวมและวิเคราะห์ข้อมูล Network Traffic, Logs, Alerts, Threat Intelligence เพื่อตัดสินใจและปรับปรุง Security Posture
กรอบงานการวิเคราะห์ (Analysis Framework)
1. Data Collection (Data Sources)
| Data Source | Examples | Collection Method |
|---|---|---|
| Network Traffic | NetFlow/IPFIX, sFlow, PCAP (Full Packet), Zeek/Bro Logs, VPC Flow Logs | TAP/SPAN/Port Mirror, Packet Broker, eBPF, Cloud VPC Flow Logs |
| Security Logs | Firewall, IDS/IPS, WAF, Proxy, VPN, NAC, DNS, DHCP, Auth Logs | Syslog, API, Forwarder (Fluentd, Vector, Logstash, Splunk UF) |
| Endpoint/Host | EDR Telemetry, Auditd, Sysmon, Windows Event Logs, OSQuery | EDR Agent, Osquery, Wazuh, Elastic Agent |
| Threat Intelligence | IOCs (IP, Domain, Hash, URL), TTPs (MITRE ATT&CK), Vuln Feeds (KEV, CVE) | STIX/TAXII, MISP, Commercial Feeds (CrowdStrike, Mandiant, AlienVault) |
| Asset/Context | CMDB, Cloud Inventory, IPAM, AD/LDAP, Vulnerability Scan Results | API, Scheduled Sync, Discovery Scans |
2. Analysis Techniques (วิธีการวิเคราะห์)
- Signature-based Detection: Known IOCs, Rules (Snort/Suricata, YARA, Sigma, STIX) — Fast, Low FP, Miss Unknown
- Anomaly/Behavioral Detection: Baseline Normal → Detect Deviation (ML/Stats: Clustering, Isolation Forest, LSTM, Peer Group) — Catch Unknown, Higher FP
- Threat Hunting (Hypothesis-driven): MITRE ATT&CK Mapping → Hunt Queries (Sigma, KQL, Splunk SPL, Elastic DSL) — Proactive
- Correlation & Enrichment: Multi-source Correlation (Network + Endpoint + Cloud + Identity + Threat Intel) → Attack Story
- Attack Graph/Path Analysis: Map Attack Paths (BloodHound, Attack Graphs) → Identify Choke Points, Crown Jewels
- Risk Scoring/Prioritization: EPSS, CVSS, Asset Criticality, Threat Context → Risk-based Vulnerability Management
3. Tools & Platforms (เครื่องมือและแพลตฟอร์ม)
| Category | Tools |
|---|---|
| SIEM | Splunk, Elastic (ELK), Microsoft Sentinel, Google Chronicle, IBM QRadar, LogRhythm, Sumo Logic |
| NDR (Network Detection & Response) | ExtraHop, Corelight (Zeek), Darktrace, Vectra AI, Arctic Wolf, Stamus Networks |
| Packet Analysis | Wireshark, Zeek (Bro), Suricata, tcpdump, PCAP Analysis (NetworkMiner, CapAnalysis) |
| Threat Hunting | Velociraptor, KAPE, OSQuery, Jupyter Notebooks (KQL/SPL/ES|QL), MITRE ATT&CK Navigator |
| Vulnerability Management | Tenable.io, Qualys VMDR, Rapid7 InsightVM, Greenbone/OpenVAS, Nuclei, Trivy |
| SOAR/Automation | Cortex XSOAR, Splunk SOAR, Tines, Torq, Shuffle, n8n |
ขั้นตอนการทำ Network Security Assessment (Practical)
- Scope & Rules of Engagement: Define Assets, Networks, Time Windows, Legal Authorization
- Passive Discovery: NetFlow Analysis, DNS Passive, Certificate Transparency, Shodan/Censys — No Active Scanning
- Active Scanning (Authorized): Nmap, Masscan, Nuclei, Nessus, OpenVAS — Port, Service, Vuln, Config
- Traffic Analysis: PCAP/Zeek — Protocol Distribution, Suspicious Connections, Beaconing, Data Transfer Volume, Encryption Coverage
- Log Analysis: Firewall Deny Logs, Auth Failures, Privilege Escalation, Admin Activity, Service Account Anomalies
- Threat Intel Matching: IOC Matching (IP, Domain, Hash, URL) → Enrichment (Whois, Passive DNS, Malware Sandbox)
- Gap Analysis: MITRE ATT&CK Coverage (Detection/Prevention Gaps), CIS Controls / NIST CSF Maturity
- Reporting: Executive Summary, Technical Findings, Risk Rating (CVSS/EPSS), Remediation Roadmap, Quick Wins
- Remediation Tracking: Ticketing (Jira/ServiceNow), SLA, Verification Scan, Regression Test
Key Metrics & KPIs สำหรับ Network Security Analysis
- MTTD (Mean Time to Detect): เวลาเฉลี่ยในการตรวจพบภัยคุกคาม
- MTTR (Mean Time to Respond/Remediate): เวลาเฉลี่ยในการตอบสนอง/แก้ไข
- Alert Volume & False Positive Rate: จำนวน Alert, % False Positive
- Coverage: MITRE ATT&CK Technique Coverage (Detection/Prevention)
- Encryption Visibility: % Traffic Inspected (TLS Decryption)
- Asset Visibility: % Managed/Unmanaged Assets Discovered
- Patch Compliance: % Critical/High Vulns Patched within SLA
Advanced Analysis: Encrypted Traffic Analysis (ETA)
เนื่องจาก >90% Traffic เป็น TLS 1.2/1.3 — ต้องใช้:
- TLS Decryption (Middlebox): Forward Proxy, Firewall SSL Inspection — Certificate Management, Privacy, Performance
- Passive ETA (No Decrypt): JA3/JA3S Fingerprinting, SNI Analysis, Certificate Metadata, Flow Analytics (Packet Size/Timing), ML-based Classification
- eBPF/Kernel-level: User-space TLS Keys (OpenSSL, BoringSSL, GnuTLS) → Decrypt ใน Kernel (Cilium Tetragon, Pixie, Kerla)
สรุป: Network Security Analysis Workflow
Collect (Network, Endpoint, Cloud, Intel, Asset)
→ Normalize & Enrich (Schema, Context, Threat Intel)
→ Detect (Signature + Anomaly + Hunting)
→ Correlate & Prioritize (Attack Story, Risk Score)
→ Investigate (Timeline, Root Cause, Scope)
→ Respond (Contain, Eradicate, Recover)
→ Improve (Update Rules, Signatures, Playbooks, Architecture)
→ Measure (KPIs, Maturity, ROI)
สำคัญที่สุด: Actionable Intelligence — Analysis ที่นำไปสู่ Action ได้จริง ไม่ใช่แค่ Dashboard สวย
