TRAFFIC FILTERING METHOD BASED ON ANALYSIS OF NETWORK INTERACTIONS OF DEVICES УДК 004.056.57

Abstract

The paper proposes a method for protecting an organization's network infrastructure based on an analysis of the network activity of interacting devices. It has been shown that infection of user devices can lead to multiple network requests being sent to other devices on the network. To identify such network activity of computers, the work used data on network interactions obtained using the Netflow protocol. By counting the number of active connections, the network addresses of infected devices are determined. To quickly block infected computers, the work implements the transfer of data about network addresses to the firewall. The use of the proposed protection method made it possible to improve the control of network interactions between devices and the protection of the local network.