Abstract: The present disclosure relates to systems and methods for detecting unauthorized system configuration changes. For example, metadata can be extracted from network traffic captured by one or more different network tools and/or network devices and provided to a metadata evaluator. As an example, the one or more different network tools and/or devices can include a switch port analyzer tool, a security information and event management tool, and/or a test access port device. The metadata evaluator can process the extracted metadata to detect a system configuration change in a system on a network that includes the network traffic. The metadata evaluator can determine whether the system configuration change is an authorized system configuration change. In some examples, the metadata evaluator can determine whether the system configuration change is an authorized system configuration change based on change management data from a change management system.

Abstract: A method for detecting Command and Control (C&C) toward a web application in a network includes: obtaining, using a Web Application Firewall (WAF) of the network, network traffic between the web application and a server outside the network; transmitting the network traffic from the WAF to a machine learning model; determining, using the machine learning model, whether the network traffic includes a command signature; in response to determining that the network traffic includes a command signature, generating a notification; and determining, based on the notification, whether the server is a C&C.

Abstract: A method for detecting Command and Control (C&C) toward a web application in a network includes: obtaining, using a Web Application Firewall (WAF) of the network, network traffic between the web application and a server outside the network; transmitting the network traffic from the WAF to a machine learning model; determining, using the machine learning model, whether the network traffic includes a command signature; in response to determining that the network traffic includes a command signature, generating a notification; and determining, based on the notification, whether the server is a C&C.