Information Security Analytics

Index

Note: Page numbers followed by “f” and “t” indicate figures and tables respectively.

A

Access analytics

argparse module, 109

csv module, 109–110

datetime module, 110

haversine distance, 116–117

“Havesine Python,” 117

Linux/Unix systems, 110

math module, 110

MaxMind GeoIP API, 116

MaxMind’s GeoIP module, 121

parse_args() function, 112

parser.add.argument method, 112

pseudocode, 116

Python, 100, 103

Codecademy, 103–104

resources, 103

Web site, 104

re module, 109

remote access Python analytics program flow, 111, 111f

result analysis

connections types, 121

haversine distance, 118–119

malicious remote connections identification, 121

User8 access behavior, 119, 119f

User90 access behavior, 119, 120f

User91 access behavior, 120, 120f

vpn.csv file, output, 117, 118f

scripting ...