Knoldus Inc

Let's Talk

Leading Cyber Security Firm

Knoldus builds a Protocol Surveillance tool to enhance network security

Download Case Study
Headquarters

USA

Industry

Network Monitoring

Technology Used

Rust, Cargo, Apache Kafka

Our partner organization is a mid-size cybersecurity organization headquartered in the US. The firm specializes in network traffic analysis and its products help clients to have a secure experience over their networks by detecting and preventing malicious activity & security threats. It taps into the power of Machine Learning and Threat Intelligence to analyze millions of exchanges on networks and is amongst the top 10 for its robust security solutions.

Challenges

The Active Directory does not make available the file location of the logs in the local file system which poses a technical challenge to access these logs.

Solutions

Prolance automated the extraction and analysis of the DHCP audit logs which monitor the network devices and prove to be an invaluable diagnostic tool when security is compromised over the network.

Results

Timely prevention of potential harm to the network as Prolance allowed keeping a check on malicious logins on workstations or illegitimate software installations/data transfers.

Impact

  • Enhanced network visibility: System administrators could now track and analyze network activity of the devices present on the network.
  • Reduced MTTD: Significant reduction in Mean Time to Detect (MTTD) and Mean Time to Resolve (MTTR) of potential threats
  • Timely Prevention: Better prevention mechanism of malicious activities

Challenges

Our partner organization wanted to enhance its network monitoring solutions with a protocol surveillance tool. System administrators were trying to find a solution so that they didn’t have to manually extract and analyze activity log files generated by these protocols on the server.

1. Monitoring the running activities of the protocols

  • The Active Directory does not make available the file location of the logs in the local file system which poses a technical challenge to access these logs.
  • When Apache Kafka was used on the Windows server, it was found to be incompatible with the Rust programming language and was unable to produce logs on the message queue.
  • There were unavoidable roadblocks while compression of logs before they could be produced on Kafka topic.

Why Network Monitoring?

In today’s world where everything is happening digitally, an unreliable network can literally bring a business to a standstill. For maintaining a healthy data center, network monitoring solutions are important so that companies can have better management and control over their networks.

These solutions can give companies the flexibility to keep track of and analyze their networks for troubleshooting & detecting any mistrustful activities in real-time.

Solution

The solution came in the form of Prolance, a protocol surveillance tool that Knoldus built on the Rust programming language. Let’s understand what this project enabled:

1. Monitoring the running activities of the protocols

Prolance was build to monitor the activities of the following network protocols -

  • Dynamic Host Configuration Protocol (DHCP) - This is a network management protocol that can dynamically assign IP addresses to client devices.
  • Active Directory (AD) - This is a Microsoft technology that allows network administrators to generate & manage domains, users, and objects along with their permissions and access control within a network.

Prolance automated the extraction and analysis of the DHCP audit logs which monitor the network devices and prove to be an invaluable diagnostic tool when security is compromised over the network. Similarly, AD logs provide an insight into possible abuse of access rights & privileges.

2. Filtering out the logs as per monitoring requirements

Once we started processing these logs, we had two scenarios - either the user requires raw logs of the protocol or logs can be filtered as per the monitoring requirements. Take, for instance, the scenario where the user is interested in obtaining only the IP addresses and the device name from thousands of DHCP logs. Filtration will be required so that only the relevant pieces of information (like Discovery, Offer Request & Acknowledge phases) are extracted as per user requirements.

3. Continuous streaming of the logs onto the Kafka Topic after compression

Whether the logs are filtered or used raw, they go through the process of compression before being produced onto the Kafka topic. Apache Kafka has been used here for message queuing which lets you scale your processing. This happens as Kafka enables you to divide the processing over multiple consumer instances. We used the gzip compression technique and enabled the user to schedule this process as per requirement.

Results

1. Enhanced network visibility as system administrators could now track and analyze network activity of the devices present on the network.

2. Timely prevention of potential harm to the network as Prolance allowed keeping a check on malicious logins on workstations or illegitimate software installations/data transfers.

3. Significant reduction in the Mean Time to Detect (MTTD) and Mean Time to Resolve (MTTR) as security teams were able to respond faster to security breaches

Explore latest Case Studies

Ready to gain a competitive advantage with Future Ready Emerging Technologies?

Let's Initiate a Partnership