Detecting anomalous network patterns

Detecting anomalous network patterns

Using anomaly patterns for improved data security, network monitoring and observability.

Make a submission

Submissions are closed for this project

Observability, anomaly detection and deep defense is the cycle for early detection of attacks and network breaches.

Speakers from FreeBSD community, CRED, AWS, Datadog, Farsight Securities and other organizations will share their experiences with processes and tools for tightening the loops of network security and anomaly detection, and how to build robust observability workflows.
The conference will cover topics ranging from:

  1. Network Security Monitoring (NSM)
  2. Unified approach to observability
  3. VPN connectivity and unusual traffic patterns
  4. Response Policy Zones (RPZ)
  5. Network behaviour analysis and early indicators of attack

The conference is open for participation to the following practitioners.

  1. SRE teams.
  2. Observability geeks.
  3. Engineers who work with Cloud infrastructure.
  4. Network security engineers.
  5. DevSecOps teams and practitioners.

See schedule at at

Contact information: Join the Rootconf Telegram group at or follow @rootconf on Twitter.
For inquiries, contact Rootconf at or call 7676332020.

Hosted by

Rootconf is a forum for discussions about DevOps, infrastructure management, IT operations, systems engineering, SRE and security (from infrastructure defence perspective). more

Supported by

Omidyar Network India invests in bold entrepreneurs who help create a meaningful life for every Indian, especially the hundreds of millions of Indians in low-income and lower-middle-income populations, ranging from the poorest among us to the existing middle class. To drive empowerment and social i… more
We’re the world’s most comprehensive and broadly adopted cloud platform, offering over 200 fully featured services from data centers globally. As a hyperscale cloud service provider, AWS provides access to highly advanced computing tools on rent for startups and SMEs at affordable prices. We help t… more
The FreeBSD Foundation is a 501(c)(3), US based, non-profit organization dedicated to supporting and promoting the FreeBSD Project and community worldwide. Funding comes from individual and corporate donations and is used to fund and manage projects, fund conferences and developer summits, and prov… more

Deep dives into privacy and security, and understanding needs of the Indian tech ecosystem through guides, research, collaboration, events and conferences. Sponsors: Privacy Mode’s programmes are sponsored by: more
Rashid Feroz

Rashid Feroz


Achieving a High Level of Network Inspection with VPC Traffic Mirroring and Suricata

Submitted May 24, 2021

COVID has hit everyone and affected people in their own way. As far as organizations are concerned, employees have been asked to work from home (WFH), and because many industries are now working remotely, the pattern of user connections to the enterprise network has turned upside down. Instead of most users connecting locally, now most are connecting remotely. And for allowing employees to access critical business functions, there is mandatory VPN connectivity.

Since the VPN instance is kept in a demilitarized zone (DMZ) to allow employees around the globe to connect to it and access internal applications, there is an unexpected flood of WFH connections, which makes VPN networks more vulnerable to all kinds of Layer7/Layer3 attacks.

We will walk through how we have strengthened security and monitoring over our public VPN instance, which was kept in the public VPC, keeping an ever-watchful eye out for unusual traffic patterns or content that could signify a network intrusion using AWS VPC Traffic Mirroring and a network intrusion detection system Suricata.


{{ gettext('Login to leave a comment') }}

{{ gettext('Post a comment…') }}
{{ gettext('New comment') }}
{{ formTitle }}

{{ errorMsg }}

{{ gettext('No comments posted yet') }}

Ravindra Ved

Anatomy of an attack

Network behaviour analysis often leads to early indicators of attack, however, network behaviour needs to be augmented with additional data points like user behaviour, data flow characteristics, threat intelligence, anonymous API calls to identify and establish threat patterns more

25 May 2021