There’s a dirty little secret in IT networks – nobody fully knows what they have on their network. Recognizing what’s on your network is important, in part because it’s hard to defend what you don’t know about. Asset lists and diagrams are constantly outdated – the second they get published. Cloud and ephemeral infrastructure is even worse because virtual machines and containers compound the problem. Signatures and stock fingerprinting techniques are also getting harder, as more and more network traffic is becoming encrypted. This talk will address these problems through a live demonstration of the tool we have built called Poseidon. Poseidon is an open source application that adds the power of machine learning to software-defined networks, such as those built by the open source Faucet controller project from New Zealand which builds software-defined enterprise networks. The combination of SDN and ML is a key ingredient to giving network defenders better situational awareness on enterprise networks while providing the ability to automate security improvements of those networks.
In 15 minutes we’ll build an SDN network using Faucet, attach devices to it, and show how Poseidon automatically reacts to those new devices, updates the network posture, and presents insight into what is on the network and what those devices are doing.