Inbound Network Traffic

Access Control Configuration

Access Control Group

Access Control List

Access Mediator

Access Process

Access Token

Activity Dependency

Address Space

Administrative Network Traffic

Alias

Allocate Memory

Application

Application Configuration

Application Configuration Database

Application Configuration Database Record

Application Configuration File

Application Installer

Application Inventory Sensor

Application Layer Firewall

Application Layer Link

Application Process

Application Process Configuration

Application Rule

Application Shim

Archive File

Artifact Server

Asymmetric Key

Audio Input Device

Authenticate User

Authentication

Authentication Function

Authentication Log

Authentication Server

Authentication Service

Authorization

Authorization Log

Authorization Service

Barcode Scanner Input Device

Binary Large Object

Binary Segment

Block Device

Boot Loader

Boot Record

Boot Sector

Browser

Browser Extension

Build Tool

Business Communication Platform Client

CA Certificate File

Processor Cache Memory

Call Stack

Central Processing Unit

Certificate

Certificate File

Certificate Trust Store

Chatroom Client

Child Process

Client Application

Client Computer

Clipboard

Cloud Configuration

Cloud Instance Metadata

Cloud Service Authentication

Cloud Service Authorization

Cloud Service Sensor

Cloud Storage

Cloud User Account

Code Analyzer

Code Repository

Collaborative Software

Network Agent

Command

Command History Log

Command History Log File

Command Line Interface

Compiler

Compiler Configuration File

Computer Network Node

Computer Platform

Computing Server

Configuration Database

Configuration Database Record

Configuration File

Configuration Management Database

Configuration Resource

Connect Socket

Console Output Function

Container Build Tool

Container Image

Container Orchestration Software

Container Process

Container Runtime

Copy Memory Function

Copy Token

Create File

Create Process

Create Socket

Create Thread

Credential

Credential Management System

Cryptographic Key

Custom Archive File

Cyber Sensor

DHCP Network Traffic

DHCP Server

DNS Lookup

DNS Network Traffic

DNS Record

DNS Server

Data Artifact Server

Data Dependency

Data Link Link

Database

Database File

Database Query

Database Server

Decoy Artifact

Default User Account

Delete File

Dependency

Deserialization Function

Desktop Computer

Developer Application

Dial Up Modem

Digital Artifact

Digital Fingerprint

Digital Information

Digital Information Bearer

Digital System

Properties

id: d3f:InboundNetworkTraffic

name: Inbound Network Traffic
definition: Inbound traffic is network traffic originating from another host (client), to the host of interest (server).

json

Neighbors

        graph LR;

    d3f:NetworkTraffic["Network Traffic"] --> | may-contain | d3f:DomainName["Domain Name"];
            class d3f:NetworkTraffic inbound_node;
            style d3f:NetworkTraffic fill:#fff4dd;
             d3f:InboundNetworkTraffic["Inbound Network Traffic"] -.-> | may-contain | d3f:DomainName["Domain Name"];
              class d3f:DomainName inbound_node;
              style d3f:DomainName fill:#fff4dd;

            click d3f:NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";
            click d3f:DomainName href "/dao/artifact/d3f:DomainName";d3f:NetworkTraffic["Network Traffic"] --> | contains | d3f:NetworkPackets["Network Packet"];
            class d3f:NetworkTraffic inbound_node;
            style d3f:NetworkTraffic fill:#fff4dd;
             d3f:InboundNetworkTraffic["Inbound Network Traffic"] -.-> | contains | d3f:NetworkPackets["Network Packet"];
              class d3f:NetworkPackets inbound_node;
              style d3f:NetworkPackets fill:#fff4dd;

            click d3f:NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";
            click d3f:NetworkPackets href "/dao/artifact/d3f:NetworkPackets";d3f:NetworkTraffic["Network Traffic"] --> | originates-from | d3f:PhysicalLocation["Physical Location"];
            class d3f:NetworkTraffic inbound_node;
            style d3f:NetworkTraffic fill:#fff4dd;
             d3f:InboundNetworkTraffic["Inbound Network Traffic"] -.-> | originates-from | d3f:PhysicalLocation["Physical Location"];
              class d3f:PhysicalLocation inbound_node;
              style d3f:PhysicalLocation fill:#fff4dd;

            click d3f:NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";
            click d3f:PhysicalLocation href "/dao/artifact/d3f:PhysicalLocation";   d3f:InboundNetworkTraffic["Inbound Network Traffic"] --> | subClassOf | d3f:NetworkTraffic["Network Traffic"];

          class d3f:NetworkTraffic inbound_node;
          style d3f:NetworkTraffic fill:#fff4dd;

          class d3f:InboundNetworkTraffic RootArtifactNode;
          style d3f:InboundNetworkTraffic fill:#fff4dd;

          click d3f:NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";
          click d3f:InboundNetworkTraffic href "/dao/artifact/d3f:InboundNetworkTraffic";

Inferred Relationships

This page is experimental and may change significantly in future releases.

Hierarchy

(filtered)

Related Countermeasure Techniques

        graph LR;

      ForwardResolutionIPDenylisting["Forward Resolution IP Denylisting"] -->
          | blocks | InboundInternetDNSResponseTraffic["Inbound Internet DNS Response Traffic"]; class ForwardResolutionIPDenylisting DefensiveTechniqueNode; class InboundInternetDNSResponseTraffic ArtifactNode; click ForwardResolutionIPDenylisting href "/technique/d3f:ForwardResolutionIPDenylisting"; click InboundInternetDNSResponseTraffic href "/dao/artifact/d3f:InboundInternetDNSResponseTraffic";InboundSessionVolumeAnalysis["Inbound Session Volume Analysis"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class InboundSessionVolumeAnalysis DefensiveTechniqueNode; class InboundInternetNetworkTraffic ArtifactNode; click InboundSessionVolumeAnalysis href "/technique/d3f:InboundSessionVolumeAnalysis"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";InboundTrafficFiltering["Inbound Traffic Filtering"] -->
          | filters | InboundNetworkTraffic["Inbound Network Traffic"]; class InboundTrafficFiltering DefensiveTechniqueNode; class InboundNetworkTraffic ArtifactNode; click InboundTrafficFiltering href "/technique/d3f:InboundTrafficFiltering"; click InboundNetworkTraffic href "/dao/artifact/d3f:InboundNetworkTraffic";Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class Client-serverPayloadProfiling DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class NetworkTrafficCommunityDeviation DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class RemoteTerminalSessionDetection DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | NetworkTraffic["Network Traffic"]; class NetworkTrafficFiltering DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";

Related Weaknesses

InboundNetworkTraffic has no related weaknesses in this release.

Related Offensive Techniques

        graph LR;

    T1566001["Spearphishing Attachment"] --> |produces| InboundInternetMailTraffic["Inbound Internet Mail Traffic"]; class T1566001 OffensiveTechniqueNode;
        class InboundInternetMailTraffic ArtifactNode; click T1566001 href "/offensive-technique/attack/T1566.001/"; click InboundInternetMailTraffic href "/dao/artifact/d3f:InboundInternetMailTraffic";T1566002["Spearphishing Link"] --> |produces| InboundInternetMailTraffic["Inbound Internet Mail Traffic"]; class T1566002 OffensiveTechniqueNode;
        class InboundInternetMailTraffic ArtifactNode; click T1566002 href "/offensive-technique/attack/T1566.002/"; click InboundInternetMailTraffic href "/dao/artifact/d3f:InboundInternetMailTraffic";T1190["Exploit Public-Facing Application"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1190 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click T1190 href "/offensive-technique/attack/T1190/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";T1498001["Direct Network Flood"] --> |creates| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1498001 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click T1498001 href "/offensive-technique/attack/T1498.001/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";T1498002["Reflection Amplification"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1498002 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click T1498002 href "/offensive-technique/attack/T1498.002/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";T1499002["Service Exhaustion Flood"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1499002 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click T1499002 href "/offensive-technique/attack/T1499.002/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";