We hope you enjoyed FloCon 2021!
Here's your chance to get caught up on presentations from Flocon 2020. Their topics included everything from sophisticated machine learning and statistical analyses to practical advice for cybersecurity analysts and decision makers.
FloCon: Fifteen Years of Data, Defense, Discussion, and Diversity
By Tim Shimeall, November 2019
FloCon, the international conference on “Using Data to Defend,” celebrates its fifteenth year with FloCon 2020 in Savannah, GA on January 6-9, 2020. FloCon 2020 offers a series of engaging talks and panels plus networking opportunities. This note provides a retrospective on the rich history of this conference.
FloCon started as a small gathering of government workers, contractors, and academics. The first FloCon, held in the fall of 2004, was by invitation only. By the second year, the conference opened to all who wanted to attend: over 80 government staff, academics, business people, and engineers. From that beginning, the conference developed into a blended mix of practitioners, investigators, implementers, and users. Typical recent attendance is slightly over 200.
Although FloCon was initially a conference that focused on formal, written papers with auxiliary presentations, by its fourth year (winter of 2008) the conference only required presentations as submissions. It saw a corresponding rise in the timeliness of the material presented, the breadth of speakers presenting, and the depth of content presented. FloCon’s purpose evolved from its opening conversations to include community building, then understanding data with standardized formats, and finally employing diversified data in defense of networks.
Presentation content moved from a tight focus on network flow data to the current, much broader focus on applying any and all collected data to defend networks. The early focus was on robustly collecting network flow data, storing it in a flexible format (IPFIX was a running topic of conversation in some of the early years), and discussing what could be found with the limited detail provided by network flow data. In more recent years, the focus shifted to using a variety of data in a merged fashion (although some presentations still discuss network flow data), supported by machine learning methods, innovative analytical hardware, and network storage devices. These analyses exploit this diverse data to track a wide range of security-critical aspects (including the size, structure, and traffic on networks) and network-based threats (including both automated and human-based threats).
These presentations were given at FloCon 2020, an annual conference that focuses on data-driven network security. Speakers from industry, government, and academia presented talks on how to apply “big data” analysis techniques to solve difficult security problems.Browse Presentations
New Orleans, LA
January 7-10, 2019
FloCon explores advanced, cutting-edge "big daya" analytics in support of security operations.Browse Presentations
January 8-11, 2018
Flocon 2018 expanded its focus to present sessions on applying analytics to ANY large-scale dataset to enhance security (not just network flow data).Browse Presentations
San Diego, CA
January 9-12, 2017
At FloCon 2017, attendees discussed the analysis of large volumes of traffic and the next generation of flow-based analysis techniques.Browse Presentations
Daytona Beach, FL
January 11-14, 2016
FloCon 2016, showcased next-generation analytic techniques and was geared toward operational analysts, tool developers, researchers, and others interested in applying the latest analytics against large volumes of traffic.Browse Presentations
January 12-15, 2015
At FloCon 2015, attendees discussed the art of network analysis and how to make it more formal, rigorous, reliable, well-grounded, and repeatable. Attendees also discussed the academic advances in novel analytics as well as operationalization and automation of well-known techniques.
Charleston, South Carolina
January 13-16, 2014
FloCon 2014 provided a forum for operational network analysts, tool developers, researchers, and other parties interested in the analysis of large volumes of traffic to showcase the next generation of flow-based analysis techniques.Browse Presentations
Albuquerque, New Mexico
January 7-10, 2013
This year, organizers and participants focused on the challenges of "Analysis at Scale” and discussed how to refine "big data" into knowledge, design methods for aggregated analyses at the network edge, and build systems for monitoring thousands or millions of assets at once.Browse Presentations
January 9-12, 2012
At FloCon 2012, participants focused on the progression of analytics from ideas, to prototypes, to tools. Attendees discussed topics such as incident case studies that sparked new ideas, how flow data can help refine a static signature, and how to identify the costs and benefits of implementing a technique at the large-scale network level versus host level.Browse Presentations
Salt Lake City, Utah
January 10-13, 2011
This year, participants explored a wide range of topics and discussed dark space, how many web servers are actually operating, spam, and how DNS servers area susceptible to cache poisoning.Browse Presentations
New Orleans, Louisiana
January 11-14, 2010
FloCon 2010 focused on flow data analysis within the context of other data sources. Presentations emphasized techniques for analyzing flow data, integrating flow data with network data sets, and engineering support for flow analysis and integration.Browse Presentations
January 12-15, 2009
At FloCon 2009, presenters discussed topics dealing with flow for network forensics, network inventory, and incident response.Browse Presentations
January 7-10, 2008
At FloCon this year, attendees described useful experiences in flow analysis and presented innovative solutions in security analysis.Browse Presentations
October 9-12, 2006
This FloCon conference included 12 papers and 13 presentations given by experts in the field of flow analysis. Discussions covered topics such as flow processing, flow measurement, network traffic, and analysis methods.Browse Presentations
September 20-22, 2005
At FloCon 2005, conference participants gathered to discuss flow and network security analysis and ways to improve these technologies.Browse Presentations
Crystal City, Virginia
July 22, 2004
At the first FloCon in 2004, attendees gave talks on analysis, infrastructure, and data sharing. Topics covered included scanning very large networks, standardization efforts to support data exchange, security at line speed with netflows, and AirCERT.Browse Presentations