Superflows: A New Tool for Forensic Network Flow Analysis

Network security analysts collect information ranging from coarse‐grained traffic summaries to fine‐grained packet contents, validating those data against expected patterns and known indicators of compromise. The volume of modern network traffic, however, vastly exceeds analysts’ capacity for effective forensic inspection. Motivated by the way packets are grouped into flows, we introduce superflows—an analyst-defined aggregation of one or more flows that share a common hypothesis about traffic behavior. We formalize the superflow construct, present practical representations and construction rules, and demonstrate through a case study how superflows can dramatically reduce the data that must be examined, thereby increasing Events Per Analyst Hour (EPAH).

arXiv preprint arXiv:2403.01314