Network Traffic Analysis with Malcolm

Seth Grover, lead developer at Idaho National Laboratory, presents a comprehensive deep-dive into "Malcolm," an open-source network traffic analysis tool suite specifically tailored for operational technology (OT), industrial control systems (ICS), and enterprise IT networks.

[23:25] Grover walks through Malcolm's modular architecture, explaining how it integrates industry-standard open-source security tools into a cohesive Docker-based environment. The platform pairs Zeek for rich network protocol metadata generation with Suricata for signature-based intrusion detection, while leveraging Arkime (formerly Moloch) for full packet capture indexing and Elasticsearch/Kibana for visualization. Grover highlights Malcolm's native support for parsing proprietary and open industrial automation protocols, including Modbus, DNP3, CIP/EtherNet-IP, and BACnet.

[47:48] The presentation demonstrates Malcolm's automated log enrichment engine, which tags network sessions with NetBox asset inventory metadata, geo-IP coordinates, and threat intelligence feeds. Grover provides a live demonstration [01:12:32] exploring complex network captures, demonstrating how analysts can filter traffic over time histograms, identify anomalous ICS command sequences, trace encrypted SSL/TLS certificate anomalies, and conduct rapid forensic incident response within critical infrastructure environments.

(AI summary — Gemini Flash)