Determining native network traffic information for virtually logged network events
Described are systems and methods for determining a native format (e.g., original state) for virtually logged network information and associating the native format with the virtually logged network information. Embodiments of the present disclosure can extract network traffic information from multiple sources and generate translation tables from each corresponding source of network traffic information. The translation tables may be sequentially queried with input network traffic information associated with a virtually logged network event to determine the native network traffic information.
1 . A computer-implemented method, comprising:
extracting a first plurality of network log data from a first network traffic log source;
populating a first translation table stored in a high-speed database with the first plurality of network log data, wherein:
the first plurality of network log data includes first translated data that causes at least a portion of a plurality of native network information associated with the first plurality of network log data to be hidden; and
the first translation table stores the first plurality of network log data in a first plurality of key-value pairs;
extracting a second plurality of network log data from a second network traffic log source;
populating a second translation table stored in the high-speed database with the second plurality of network log data, wherein the second translation table stores the second plurality of network log data in a second plurality of key-value pairs;
receiving an input data element associated with a logged network event, wherein:
the logged network event corresponds to at least one of a security incident or a network outage; and
the input data element includes at least a source address, a source port, and a timestamp associated with the logged network event;
querying, using the input data element, the first translation table to determine a first key-value pair from the first plurality of key-value pairs;
querying, using the input data element and the first value of the first key-value pair, the second translation table to identify a second key-value pair from the second plurality of key-value pairs, wherein the second key-value pair corresponds to native network information for the logged network event;
associating at least a portion of a second value of the second key-value pair with the input data element; and
providing the second value to at least one of a plurality of tools to resolve the logged network event.
2 . The computer-implemented method of claim 1 , wherein querying the first translation table further includes identifying the first key-value pair based at least in part on the source address, the source port, and the timestamp of the input data element and a key source address, a key source port, and a key timestamp associated with the first key-value pair.
3 . The computer-implemented method of claim 1 , wherein:
the first network traffic log source includes a NetFlow log; and
the second network traffic log source includes a syslog server.
4 . The computer-implemented method of claim 1 , wherein the second value of the second key-value pair includes at least one of a native source address or a native source port.
5 . A computer-implemented method, comprising:
populating a first translation table with a first plurality of network traffic information from a first network traffic log, wherein the first plurality of network traffic information includes first translated data that causes at least a portion of a plurality of native network information associated with the first plurality of network traffic information to be hidden;
populating a second translation table with a second plurality of network traffic information from a second network traffic log;
querying the first translation table using network traffic information associated with a logged network event to correlate the logged network event to a first entry in the first translation table to obtain first untranslated information associated with the first entry in the first translation table, wherein the logged network event corresponds to at least one of a security incident or a network outage;
querying the second translation table using the network traffic information associated with the logged network event and the first untranslated information to correlate the logged network event to a second entry in the second translation table to obtain second untranslated information associated with the second entry in the second translation table; and
returning the second untranslated information to at least one of a plurality of tools to resolve the logged network event, wherein the second untranslated information corresponds to native network information for the logged network event.
6 . The computer-implemented method of claim 5 , wherein the first plurality of network traffic information includes at least one of:
a first plurality of translated source addresses associated with a first plurality of network events;
a first plurality of untranslated source addresses associated with the first plurality of network events;
a first plurality of translated source ports associated with the first plurality of network events; a first plurality of untranslated source ports associated with the first plurality of network events; or
a first plurality of timestamps associated with the first plurality of network events.
7 . The computer-implemented method of claim 6 , wherein:
the first translation table includes a first plurality of key-value pairs that include a first plurality of keys and a first plurality of corresponding values;
the first plurality of keys are defined by at least one of the first plurality of translated source addresses or the first plurality of translated source ports; and
the first plurality of corresponding values includes at least one of the first plurality of untranslated source addresses or the first plurality of untranslated source ports.
8 . The computer-implemented method of claim 7 , wherein:
the network traffic information associated with the logged network event includes a source address, a source port, and a timestamp; and
querying the first translation table includes:
determining a first key from the first plurality of keys based at least in part on the source address, the source port, the first plurality of translated source addresses, and the first plurality of translated source ports; and
determining, based at least on the timestamp and the first plurality of timestamps, a first corresponding value associated with the first key as the first untranslated information.
9 . The computer-implemented method of claim 8 , wherein determining the first corresponding value includes adjusting at least one of the timestamp or at least one of the first plurality of timestamps to compensate for at least one of a jitter or a latency.
10 . The computer-implemented method of claim 8 , wherein:
the second plurality of network traffic information includes at least one of:
a second plurality of translated source addresses associated with a second plurality of network events;
a second plurality of untranslated source addresses associated with the second plurality of network events;
a second plurality of translated source ports associated with the second plurality of network events;
a second plurality of untranslated source ports associated with the second plurality of network events; or
a second plurality of timestamps associated with the second plurality of network events;
the second plurality of translated source addresses corresponds to the first plurality of untranslated source addresses; and
the second plurality of translated source ports corresponds to the first plurality of untranslated source ports.
11 . The computer-implemented method of claim 10 , wherein:
the second translation table includes a second plurality of key-value pairs that include a second plurality of keys and a second plurality of corresponding values;
the second plurality of keys are defined by at least one of the second plurality of translated source addresses or the second plurality of translated source ports; and
the second plurality of corresponding values includes at least one of the second plurality of untranslated source addresses or the second plurality of untranslated source ports.
12 . The computer-implemented method of claim 11 , wherein querying the second translation table includes:
determining a second key from the second plurality of keys based at least in part on the source address, the source port, and the first untranslated information; and
determining, based at least on the timestamp and the second plurality of timestamps, a second corresponding value associated with the second key as the second untranslated information.
13 . The computer-implemented method of claim 5 , wherein the network traffic information associated with the logged network event includes multiple manipulations.
14 . A computing system, comprising:
one or more processors; and
a memory storing program instructions that, when executed by the one or more processors, cause the one or more processors to at least:
extract first network traffic information associated with a first network event from a first network traffic log, wherein:
the first network traffic information includes a first translated source address, a first translated source port, a first untranslated source address, a first untranslated source port, and a first timestamp; and
the first translated source address and the first translated source port cause native network information associated with the first network event to be hidden;
generate a first key for a first translation table based on the first network traffic information;
extract second network traffic information associated with the first network event from a second network traffic log, wherein the second network traffic information includes a second translated source address, a second translated source port, a second untranslated source address, a second untranslated source port, and a second timestamp;
generate a second key for a second translation table based on the second network traffic information;
query, using input traffic information associated with a logged network event, the first translation table to correlate the logged network event with the first key, wherein the logged network event includes at least one of a security incident or a network outage;
query, using the input traffic information and a first value associated with the first key, the second translation table to correlate the logged network event with the second key;
associate a second value associated with the second key with the logged network event, wherein the second value associated with the second key corresponds to native network information for the logged network event; and
provide the second value to at least one of a plurality of tools to resolve the logged network event.
15 . The computing system of claim 14 , wherein:
querying the first translation table includes determining the first key from a first plurality of keys based at least in part on the first translated source address, the first translated source port, and the first timestamp; and
the first value includes the first untranslated source address and the first untranslated source port.
16 . The computing system of claim 15 , wherein querying the second translation table includes determining the second key from a second plurality of keys based at least in part on the first untranslated source address, the first untranslated source port, and the second timestamp.
17 . The computing system of claim 15 , wherein determining the first key includes adjusting at least one of the first timestamp or a timestamp associated with the input traffic information to compensate for at least one of a jitter or a latency.
18 . The computing system of claim 14 , wherein the second value of the second key is a native format of the input traffic information.