SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript...
Transcript of SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript...
![Page 1: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/1.jpg)
© 2016 Carnegie Mellon University
SilkWeb – Analyze silk data through API and Javascript frameworks
Silkweb – Flocon Jan 2017
![Page 2: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/2.jpg)
2© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Copyright and license
![Page 3: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/3.jpg)
3© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Presentation agendaØ Introduction and BackgroundØ SilkWeb in a nutshellØ SilkWeb componentsØ Silkweb in a world of frameworksØ Silk CLI capabilities in SilkWebØ Use cases from NOC and SOCØ Demo on live dataØ Limitations and way forward
![Page 4: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/4.jpg)
4© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Introduction and BackgroundØ Authors : Vijay Sarvepalli & Dwight BeaverØ Sponsors : DOD, DISAØ Collaborators : MPW (ISP)Ø Recognition of roles and support
1 TTL – Time To Learn.
Architecture== can go either way
Automation== needs API
Visualization== lower TTL
![Page 5: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/5.jpg)
5© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
SilkWeb in a nutshellØ SilkWeb is a web application software.ØSilkWeb is designed to simplify access to a SiLKdata repository through network data access (JSON/XML over webservices)
ØSilkWeb is built with the modern design patterns (AJAX, View-Controller)
Ø SilkWeb is NOT a standalone web-UI for Silk, it is designed to work with multiple modern software frameworks (SIEM/Dashboards etc.)
1 SiLK - the System for Internet-Level Knowledge built by SEI CERT division.
![Page 6: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/6.jpg)
6© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Web server
Components of SilkWeb (3-tier)
Silkapi
Proxy/Cache Proxy/Cache
API clients
Web server
Silkapi
SiLK data
BrowserInterpretedDynamicUntypedHigh-levelContent-oriented
CachingAuthenticationReuseScale
Class-orientedConfig-basedLambda-calculusCommon-GatewayApp engine model
Scalable dataFile-basedBinary-optimizedCompressed
XML-over-HTTPJSON-over-HTTP
XMLJSONCSV
Binary
Presentation
Caching
Processing
Data
![Page 7: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/7.jpg)
7© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
SilkWeb in a world of frameworks
Data-DrivenDocuments
![Page 8: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/8.jpg)
8© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
SilkWeb in DISA lab at SEI
Ø Modes of integrating SilkWeb to DashboardØ iFrame, IWC widget, component widget, JSON API, XML API
ØConsideration browser XSS and authentication
![Page 9: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/9.jpg)
9© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Silk CLI capabilities built into SilkWebØ Rwfilter simple searches
Ø Rwstats group by searches
Ø
Ø Rwstats with time-bin
![Page 10: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/10.jpg)
10© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Use cases and live demo Ø DDOS workflow (MPW use case)Ø Build entity graphs of compromised home routersØ Dyn DDOS analysisØ Building qualifiers to move to “Analysis Pipeline”Ø Find unauthorized port/protocolsØ Call JSON/XML data from APIØ Call JSON data from CLI
![Page 11: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/11.jpg)
11© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
DDOS workflow
![Page 12: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/12.jpg)
12© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Compromised home routers – entity graph
![Page 13: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/13.jpg)
13© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Dyn DDOS analysis
Ø The day that your tweets died
![Page 14: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/14.jpg)
14© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Screenshots basic search
![Page 15: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/15.jpg)
15© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Screenshot pivoting from D3 graph
![Page 16: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/16.jpg)
16© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Demo of Stats and summary by time
![Page 17: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/17.jpg)
17© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
JSON/XML API for other widgets to consume
![Page 18: SilkWeb – Analyze silk data through API and Javascript frameworks · 2017-05-19 · Javascript frameworks Silkweb – Flocon Jan 2017. 2 ... frameworks (SIEM/Dashboards etc.) 1](https://reader035.fdocuments.us/reader035/viewer/2022070721/5ee33de9ad6a402d666d3d69/html5/thumbnails/18.jpg)
18© This material has been approved for public release and unlimited distribution.Please see Copyright notice for non-US Government use and distribution.
Limitations and Way forwardØ JSON/XML is noisy throttle and use wiselyØ Test with command line and understand limitationsØ Be careful with calculus
Ø In-memory IPSets are used in lambda functions
Ø Move to your graphics platform once you understand D-3
Ø Use asynchronous to keep user engaged not to fool the analysis.
Ø Try it!