Tool Demo - Riverside | Kaitlyn DeValk | WWHF Deadwood 2022

### Overview In this talk at WWHF Deadwood 2022, Kaitlyn DeValk presents Riverside, an open-source network security visualization tool she began developing during her Master's in Computer Science at the University of Maryland. Drawing from her background as a U.S. Coast Guard officer conducting penetration testing, vulnerability assessments, and red teaming at Coast Guard Cyber Command, DeValk discusses the persistent challenge of outdated, static network maps and the lack of accessible visualization tools outside expensive commercial software. Riverside was created as a proof-of-concept to offer real-time and historical network visibility through an interactive graphical interface.

### Key Topics - **User-Informed Interface Design**: DeValk conducted interviews with network administrators and security analysts to understand user preferences, gathering feedback on diagram layouts (node-link diagrams, hierarchical views, and tabular formats). - **Architecture and Data Ingestion**: The system relies on standalone Golang agents running packet capture via Berkeley Packet Filters (BPF) and deep packet inspection (DPI) to extract netflow data. Data is forwarded via gRPC to a Golang server, stored in PostgreSQL, and communicated to a JavaScript front end via WebSockets. - **Interactive Temporal Visualization**: A dynamic timeline tracks real-time traffic while allowing users to scrub backward to inspect historical network states. - **Visual Encoding and Customization**: Network nodes and edges visually reflect operational metadata, including protocol-based edge coloring, communication duration, frequency-based node transparency, and analyst customization.

### Technical Details - **Backend & Communication**: Both the agents and the central server are written in Go. Agents capture network traffic similarly to tcpdump, requiring elevated permissions, and communicate with the server over gRPC (tested locally on port 1533). Configurations are handled via YAML files. The server uses the Gin framework for API and session management, while an ORM facilitates database management with PostgreSQL (deployed via Docker). Data models include tables for hosts (agents), remote hosts, and netflow records. - **Packet Inspection**: The agent uses the `go-dpi` library for deep packet inspection to classify protocols (tracking roughly 12 protocols, such as DNS colored purple, SSL/HTTPS colored green, SMB, FTP, and RDP, falling back to gray/unknown if unclassified). - **Visual Representation**: Agent nodes are differentiated from remote nodes (which default to gray). Edges show directionality (single or double-sided arrows) and throughput. Edges widen as continuous communication persists. Nodes incorporate a transparency mechanic where frequently communicating hosts fade, making rarer or newer connections stand out. Users can modify node labels, shapes, and colors during incident triage. - **Compatibility**: Agents were tested across operating systems including Windows 10, Windows 11, Linux (Ubuntu, Kali, Pop!_OS), and within virtual machine environments.

### Takeaways & Future Work Riverside is presented as a supportive tool to augment network visibility rather than a complete replacement for security toolsets. While the backend and binaries were released on GitHub, planned enhancements include front-end data filtering, visual timeline stamping for investigator actions, automated clustering for network segmentation, integration with external threat intelligence APIs (such as GreyNoise), and testing at larger enterprise network scales.