- [Instructor] Data normalization
is the process of capturing, storing,
and analyzing data, right?
So in this case, actually,
security-related events, logs from servers, firewalls,
IPS systems, and many others, right?
So one of the main goals of data normalizations
is actually to purge and delete redundant data
and to maintain data integrity itself, right?
So the normalized data is protected
by making sure that any manifestation
of the same data elsewhere
is only making a reference to the data
that is actually being stored.
Another goal of security data normalization
is to eliminate the risk of evasion techniques
and ambiguities within your network, right?
There are different types of normalization techniques,
depending on levels of increasing complexity.
Now, here, I'm actually showing the three different types
of data normalization categories
that are mostly used in the industry, right?
One is actually referred to as 1NF,
which is the first normal form.
And you can assume the following, right,
so it's second normal form and third normal form.
And these categories can continue to increase
in forms and complexity, depending on the requirements
and the environmental needs of your organization.
In the case of intrusion prevention systems,
they focus on the throughput emphasis
for the most rapid and optimal inline performance, right?
So when doing so, in most cases, it's actually impossible
for full normalization to take place, right?
Traditional IPS devices often relied on shortcuts
that only implement partial normalization
and partial inspection.
This, of course, increased the risk
of evasion techniques, right,
or evasions of that IPS system.
Now, fragmentation is an example of innovation technique.
Also encryption, pivoting,
using type of stepping stone attacks,
and some other ones that are out there.
The good news is that next-generation IPS devices
perform data normalization in a much effective way, right?
They analyze data as a normalized stream
instead of actually analyzing data
as single or combined packets in the network, right?
So this ensure that there's a unique way
to interpret network traffic
passing through the security appliance or the IPS device.
Now, in the following lessons
we will actually cover how to interpret common data values
into a universal format.