analyzing network infrastructure with neo4j

NEO4JANALYZING NETWORK INFRASTRUCTURE WITH

ANALYZING NETWORK INFRASTRUCTURE WITH NEO4J

WHY?

▸ Visual analysis is more natural than textual analysis

▸ Because graphs are the most efficient and natural way of working with data

▸ Big network infrastructure is headache for System Administrators and DevOps

▸ Firewall rules are forgotten

▸ No one knows about traffic type between hosts

▸ What is this shit, «gocheck» service? o_O

▸ And because it is fun :)


HOW?

▸ Install Neo4j

▸ Collect needed data from hosts

▸ Parse data

▸ Load data into Neo4j

▸ Analyze! :)


BENEFITS

▸ Relationships with direction between hosts based on:

▸ Firewall rules

▸ Traffic

▸ Services that installed on each host with ability to:

▸ View all hosts that contain concrete service

▸ Check service usage (based on traffic or firewall rules)


BENEFITS

▸ Ability to find cases like:

▸ Forgotten firewall rules based on rule and traffic analyze

▸ Network services without rule or traffic to it (with loopback of course)

▸ Unused traffic (for example Zabbix agents without Zabbix endpoint)

▸ Ability to find and prevent security breaches like:

▸ Open SSH to whole internet (0.0.0.0/0)

▸ Vulnerable services with open ports

▸ And etc :)

WITH SYSTEM OVERVIEW

EXAMPLES AND CODE

ANALYZING NETWORK INFRASTRUCTURE WITH NEO4J ТЕКСТ

DATA COLLECTING

stasiand

Host 1

Host 2

Host N

iptables, netstat, tcpdump


DATA PARSING

▸ Data readers for each data format

▸ IpTables

▸ Netstat

▸ Tcpdump

▸ Import controller (Neo4jImporter)


DATA PARSING

▸ Reader interface (for IoC container) with default realization

▸ Parser interface

▸ Concrete parser realizations with magic inside :)


IOC CONTAINER CONFIGURATION


IMPORT MAGIC!


CYPHER QUERIES


FUNNY CIRCLES!


OPEN SSH PORTS


SSH TRAFFIC


SERVICES ON UTILITY


INBOUND/OUTBOUND TRAFFIC ON UTILITY


FIREWALL RULES ON UTILITY


HOSTS WITH APACHE SERVICE


HOSTS WITH B17 SERVICE TRAFFIC


HOSTS WITH HTTP TRAFFIC


EPP TRAFFIC FROM CHECK AVAILABILITY


ALL RELATIONS OF SOME RANDOM HOST


ZABBIX TRAPPER TRAFFIC TO HOSTS WITHOUT ZABBIX SERVER

THANKS FOR WATCHING

Yaroslav Lukyanov

analyzing network infrastructure with neo4j

Presentations & Public Speaking