Network Flow Mapping
Relevant source files
The following files were used as context for generating this wiki page:
Network Flow Mapping in Horizon is a specialized module designed to provide granular visibility into organizational network architecture. It functions by discovering network interfaces, aggregating traffic patterns, and visualizing the resulting topology to detect anomalies and map dependencies.
The system utilizes lightweight agents deployed across the infrastructure to collect interface data and flow metadata, which is then processed by the central API server. This mapping is critical for security posture assessment, as it enables the identification of unusual network behavior through AI-powered pattern recognition and behavioral baselining.
Sources: README.md:73-78, IMPLEMENTATION_PLAN.md:659-663
Architecture and Data Flow
The architecture of the Network Flow Mapping system follows a distributed collection and centralized analysis model. Agents running on various platforms (Linux, Windows, macOS) perform localized discovery of network interfaces and aggregate flow sessions.
Data Collection Lifecycle
The following diagram illustrates the flow of network metadata from the local agent to the central persistence and visualization layers:
The flow begins with the agent collecting interface details (MAC, speeds, addresses) and tracking active sessions, which are then transmitted via a secure mTLS protocol to the API server.
Sources: IMPLEMENTATION_PLAN.md:105-108, IMPLEMENTATION_PLAN.md:465-470, IMPLEMENTATION_PLAN.md:683-690
Core Components
The system is divided into several functional areas responsible for discovery, tracking, and analysis.
Interface and IP Discovery
This component tracks all physical and virtual network interfaces, including IP address allocations and subnet memberships.
- Subnet Tracking: Manages CIDR notations and address allocation.
- Interface Discovery: Automates the collection of MAC addresses, link speeds, and bound IP addresses from agents.
- DNS Resolution: Tracks the mapping of IP addresses to hostnames over time.
Sources: IMPLEMENTATION_PLAN.md:665-675, IMPLEMENTATION_PLAN.md:465-470
Flow Collection and Aggregation
Traffic data is not stored as raw packets but as normalized flow sessions to maintain performance and reduce storage overhead.
| Component | Description |
|---|---|
| Flow Parser | Normalizes raw data from agents into a standard internal format. |
| Session Aggregator | Groups individual packets into flow sessions based on direction and classification. |
| Flow Direction | Classifies traffic as inbound, outbound, or lateral (internal). |
| Statistics Engine | Calculates bandwidth usage and session frequency per asset. |
Sources: IMPLEMENTATION_PLAN.md:677-681
Network Data Model
The persistence layer uses several relational tables to maintain the state of the network and historical traffic patterns.
This ER diagram represents the structural relationships between assets and their network metadata as defined in the implementation roadmap.
Sources: IMPLEMENTATION_PLAN.md:659-663
Analysis and Anomaly Detection
Network Flow Mapping leverages "Inference-First" AI strategies to identify security risks. By utilizing remote providers (OpenAI, Anthropic) or CLI-based tools, the system performs behavioral baselining.
- Behavioral Baselining: Establishes a "normal" traffic profile for specific assets or subnets.
- Anomaly Detection: Identifies deviations such as unexpected lateral movement or exfiltration patterns.
- Impact Analysis: Links network flows to the Business Impact Analysis (BIA) module to determine which critical business functions are affected by a network disruption.
Sources: IMPLEMENTATION_PLAN.md:692-696, IMPLEMENTATION_PLAN.md:710-715, IMPLEMENTATION_PLAN.md:1011-1014
Security and Integrity
Communications between the agents collecting flow data and the API server are secured using high-grade cryptographic standards managed by the RustCrypto stack.
- Authentication: Mutual TLS (mTLS) using server-issued certificates.
- Message Signing: Bidirectional Ed25519 signatures ensure flow data has not been tampered with in transit.
- Encryption: ChaCha20-Poly1305 is used for the transport of sensitive network metadata.
- Audit Trails: Every change to the network topology or interface configuration is recorded in an audit trail.
Sources: README.md:143-150, IMPLEMENTATION_PLAN.md:120-135, IMPLEMENTATION_PLAN.md:793-798
Summary
Network Flow Mapping in Horizon provides a comprehensive view of IT infrastructure by combining automated interface discovery with AI-powered traffic analysis. By integrating directly with the Asset Inventory and Business Impact Analysis modules, it allows organizations to not only see their network topology but also understand the operational and security significance of every data flow.
Sources: README.md:38-40, IMPLEMENTATION_PLAN.md:46-51