|
|
IP Flow Filtration and Profiling
Sedlák, Michal ; Tisovčík, Peter (referee) ; Kučera, Jan (advisor)
This thesis addresses the problem of filtering and profiling IP flows, primarily data of IPFIXsystems. Within the work, a general filtering component is designed and implemented, whichaims to be sufficiently efficient and flexible for use in other projects related to IP flows. Thiscomponent is then adapted to work with data in the IPFIX protocol format and integratedinto the existing modular collector IPFIXcol2 in the form of plugins adding the support forfiltering of passing IPFIX data and their sorting into profiles.
|
|
|
Packet Filtration in 100 Gb Networks
Kučera, Jan ; Matoušek, Jiří (referee) ; Kořenek, Jan (advisor)
This master's thesis deals with the design and implementation of an algorithm for high-speed network packet filtering. The main goal was to provide hardware architecture, which would support large rule sets and could be used in 100 Gbps networks. The system has been designed with respect to the implementation on an FPGA card and time-space complexity trade-off. Properties of the system have been evaluated using various available rule sets. Due to the highly optimized and deep pipelined architecture it was possible to reach high working frequency (above 220 MHz) together with considerable memory reduction (on average about 72% for compared algorithms). It is also possible to efficiently store up to five thousands of filtering rules on an FPGA with only 8% of on-chip memory utilization. The architecture allows high-speed network packet filtering at wire-speed of 100 Gbps.
|
|
|
Generation of Binary Prefix Tree According to Probabilistic Parameters
Ženčák, Tomáš ; Kučera, Jan (referee) ; Matoušek, Jiří (advisor)
The goal of this work is to create a prefix set generator which will be capable of generating a prefix set from parameters specified in the ClassBench toolset. This work describes a possible approach to generation, as well as the final algorithm for prefix set generation. The resulting generator is able to generate prefix sets whose average deviation from the target parameters is typically orders of magnitude lower than the deviation of sets generated by ClassBench.
|
|
|
Hardware-Accelerated Device for Protection Against DoS Attacks
Kuka, Mário ; Kekely, Lukáš (referee) ; Kučera, Jan (advisor)
This thesis deals with the development of a firmware for hardware-accelerated device used as a protection against amplification (D)DoS attacks. In the today's world, (D)DoS attacks are very common and cause significant financial damages. Therefore the goal is to create affordable and easy to deploy centralized device that would resolve this issue. To reach this goal, a hardware accelerator is being used for the high-volume data transfer processing through a single commonly used server. Design and implementation of the firmware had been done considering the fact that this device will be used in the networks with 100\,Gbps speed. The whole system had undergone functional verification and its real throughput was verified within the laboratory testing as well. Created device has been already deployed into the CESNET network infrastructure during the time of the writing of this thesis and it has been tested by the network administrators. Based on the received feedback, the development will continue focusing on expanding of the detection of more types of attacks.
|
|
|
Heuristic Methods for the Mitigation of DDoS Attacks that Abuse TCP Protocol
Goldschmidt, Patrik ; Wrona, Jan (referee) ; Kučera, Jan (advisor)
TCP SYN Flood is one of the most wide-spread DoS attack types used on computer networks nowadays. As a possible countermeasure, this thesis proposes a network-based mitigation method TCP Reset Cookies. The method utilizes the TCP three-way-handshake mechanism to establish a security association with a client before forwarding its SYN data. The algorithm can effectively mitigate even more sophisticated SYN flood attacks at the cost of 1-second delay for the first established connection. However, the method may not be suitable for all the scenarios, so decision-making algorithm to switch between different SYN Flood mitigation methods according to discovered traffic patterns was also developed. The project was conducted as a part of security research by CESNET. The discussed implementation of TCP Reset Cookies is already integrated into a DDoS protection solution deployed in CESNET's backbone network and Czech Internet exchange point at NIX.CZ.
|
|
|
Mitigation of DDoS Attacks Exploiting Packet Fragmentation
Nešpor, Patrik ; Vrána, Roman (referee) ; Kučera, Jan (advisor)
This bachelor's thesis deals with the development of new mitigation strategies that are designed to suppress DDoS attacks that exploit packet fragmentation. It analyses fragmented traffic primarily emphasizing the order of fragmented packets. Based on the result of the analysis, it implements a new heuristic method for port numbers inference. The work also measures the latency and throughput of newly implemented functionalities. All new methods are integrated in a project developed by the CESNET association.
|
|
|
Mitigation of DoS Attacks Using Machine Learning
Goldschmidt, Patrik ; Kekely, Lukáš (referee) ; Kučera, Jan (advisor)
Útoky typu odoprenia služby (DDoS) sú v dnešných počítačových sieťach stále frekventovanejším bezpečnostným incidentom. Táto práca sa zameriava na detekciu týchto útokov a poskytnutie relevantných informácii za účelom ich mitigácie v reálnom čase. Spomínaná funkcionalita je dosiahnutá s využitím techník prúdového dolovania z dát a strojového učenia. Výsledkom práce je sada nástrojov zastrešujúca celý proces strojového učenia - od vlastnej extrakcie príznakov cez predspracovanie dát až po export natrénovaného modelu pripraveného na nasadenie v produkcii. Experimentálne výsledky vyhodnotené na viacerých reálnych a syntetických dátových sadách poukazujú na presnosť systému väčšiu ako 99% s možnosťou spoľahlivej detekcie prebiehajúceho útoku do 4 sekúnd od jeho začiatku.
|
|
|
P4 Language-Based Description of Accelerated Device against DoS Attacks
Kuka, Mário ; Kekely, Lukáš (referee) ; Kučera, Jan (advisor)
This thesis describes the development of a networking device used to defend against (D)DoS attacks using P4 language. The main purpose was to design flexible device using P4 lan-guage based on already existing device, this would allow us to quickly react and respond to new more complex DDoS attacks. The design of the device dealt with the transfer of individual parts of the firmware into the P4 language. Subsequently, the entire device firmware was designed for hardware accelerators with FPGA technology. The firmware had been designed with respect to the limitations of current P4 language compilers. The device has been tested under laboratory conditions for functionality and performance. The device will be deployed in the network infrastructure of CESNET.
|
|
|
Proposol Lean Manufacturing Products using Kaizen to Ensure the Quality
Bubeníková, Petra ; Kučera, Jan (referee) ; Jurová, Marie (advisor)
The aim of this thesis is to analyze the current state of the manufacturing process of the company ALFA s.r.o. Moravská Třebová, to submit own suggestions for the introduction of lean production to save time, costs and strengthening of the quality in the company and establish the conditions of implementation, in which is possible to implement specified proposals. The operational objective is also an explanation of benefits that gets the company after implementation of these proposals. The first part gives an overview of lean manufacturing methodologies and with using of selected methods and workflow analysis are determined in the second part the proposals. After their implementation the company can save time, reduce costs and strengthen quality for the customer as a basis for the introduction of lean manufacturing enterprise.
|
|
|
Design of an optical access network
Kučera, Jan ; Filka, Miloslav (referee) ; Münster, Petr (advisor)
Bachelor Thesis deals with the optical access network, mostly with the passive ones. It aims for current trends of users connecting to the optical access network by using FTTx connections, moreover the thesis aims on DOCSIS technology and G.Fast. Due to a focus on DOCSIS and G.Fast metallic elements are discussed too. In the practical part of bachelor thesis the theoretical knowledge in solving of access optical networks are applied. The proposal involves the technical solution of the building optical access networks, technology, attenuators balance and calculation of network. Thereafter there is discussed the simulation of the proposed project, verification of the correctness of the proposal and its evaluation.
|
guest ::
RSS feed.