IEEE/ICACT20210179 Slide.05        [Big Slide]       Oral Presentation
We found a problem with flow-based PCA using First-N. For security and privacy issue, please understand that the photos were mosaicized. The PCA marks packet of the closest time to suricata log's timestamp. But, In some cases, the timestamp of suricata log and packet reception time don't match. Packets marked in the shape of magnifiers in the figure may not be matching packets with rules. That is, marked packets may not be attack packets.

[Go to Next Slide]
Select Voice: