What is Network security monitoring?

Network Security Monitoring (NSM) is widely explored by experts around the world who insists on achieving data protection and security across the internet. There are various projects based on the Network Security Monitoring is carried out by top leading research organization. NSM is not an IDS, although it relies on IDS-like products as part of an integrated data collection and analysis suite. NSM involves collecting the full spectrum of data types (event, session, full content and statistical) needed to identify and validate intrusions, explains Richard.

NSM is more concerned with network auditing than with real-time identification of intrusions. Although encryption denies the analyst the ability to see packet contents, it doesn't deny analysts the ability to see traffic patterns. Simply knowing who talked to whom, and when, is more information than most enterprises are collecting today.

 The Bro Network Security Monitor provides defenders with visibility into all the machines on a network, the ability to tap into network traffic and examine network packets, and analyzers to examine the application layer. Defenders use Bro's domain-specific scripting language to create site-specific monitoring policies. According to the project website, Bro is used heavily in scientific environments such as universities, research labs, and supercomputing centers.

OSSEC combines a host-based intrusion detection system with log monitoring and SIEM (security information and event management) capabilities for a range of platforms, including Linux, Mac OS, Solaris, AIX, and Windows. Security teams use OSSEC for log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerts, and active response. Organizations can meet compliance requirements by configuring OSSEC to send alerts about unauthorized file system modifications and malicious behavior embedded in the software logs.

Moloch is a large-scale, full-packet-capturing indexing and database system that helps security teams with incident handling, network security monitoring, and digital forensics. Moloch complements existing intrusion detection systems by providing administrators with a way to browse, search, and export all captured network traffic. The system consists of a single-threaded C application to capture traffic data, a Node.js application to handle the user interface, and an Elasticsearch database.