FloCon 2020

This session will describe a process for testing analytics and qualifying them for usage to inform ongoing network defense. The talk starts with a brief discussion of what analytics are and describes some ways in which they fail. A sample analytic is introduced as a running example. Based on this foundation, the talk covers principles for testing analytics in general and the sample analytic in particular. As the principles are introduced, sample testing and results from that testing are provided. The talk concludes with a discussion of what it means to qualify an analytic for use and why such qualification is useful to network defenders.

Attendees Will Learn:
Network analytics have typically been developed and have often been deployed in an on-demand, ad-hoc manner. This has the advantage of timeliness but may lead to reliability and performance issues. This talk discusses how to identify such issues and make informed decisions as to the limitations of a given analytic.