You can use anomaly-based detection to mitigate DDoS attacks and zero-day outbreaks. You must define what is considered to be normal behavior. Anomaly-based analysis keeps track of network traffic that diverges from “normal” behavioral patterns. You can use NetFlow as an anomaly detection tool. Your goal should be to eliminate any network blind spots. When defending against the enemy, you must know your own territory and implement defense mechanisms in place. Remember that network security is a constant war. In addition, you should create strategic network diagrams to clearly illustrate your packet flows as well as where, within the network, you may enable security mechanisms to identify, classify, and mitigate the threat. You can achieve this level of network visibility through existing features on network devices you already have and on devices whose potential you do not even realize. You cannot protect against or mitigate what you cannot view/detect. The first step in the process of preparing your network and staff to successfully identify security threats is achieving complete network visibility. Complete visibility is one of the key requirements when identifying and classifying security threats. The Cisco Cyber Threat Defense (CTD) solution uses NetFlow as the primary security visibility tool. It provides anomaly detection and investigative capabilities that can be helpful in incident response.

NetFlow for Cybersecurity and Incident Response

Netflow analysis tools