June 2016
Beginner to intermediate
376 pages
8h 58m
Japanese
Content preview from データ分析によるネットワークセキュリティ
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
73
5
章
SiLK
スイート
SiLK（System for Internet-Level Knowledge）は、もともとカーネギーメロンのCERTが大規模
なNetFlow分析を行うために開発したツールキットである。現在SiLKは、米国国防総省、学術機関、
産業界で基本的な分析ツールキットとして使われている。
本章は SiLK を主に分析ツールとして使う。CERT Network Situational Awarenessチームが、
SiLKの使用法、コレクタのインストール、SiLKスイートの設定に関する豊富な参考文献（http://
tools.netsa.cert.org/）を公開している。
5.1
SiLK
とその機能
SiLKは、NetFlowデータの問い合わせや分析を行うためのツール群である。SiLKスイートは、
膨大なネットワークトラフィックを迅速かつ効率的に問い合わせることを可能にする。複雑な情報を
集
約して現象を特定したり、個々のイベントを抽出することができる。
SiLKは、コマンドラインで用いるデータベースだと考えてもよい。各ツールコマンドは特定
の問い合わせ、操作、データの集約を実行する。コマンドを鎖状につなげることで結果を生成す
る。SiLKでは、パイプで複数のレコードをつなげることで、複数チャネルのデータを同時に処理
する複雑なコマンドを作成できる。例えば、以下の一連のSiLK問い合わせは、フローデータから
HTTP（ポート80）トラフィックを取得し、最も活発なアドレスでの活動の時系列と ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.