|
|
Detection of Network Anomalies Based on NetFlow Data
Czudek, Marek ; Bartoš, Václav (referee) ; Kořenek, Jan (advisor)
This thesis describes the use of NetFlow data in the systems for detection of disruptions or anomalies in computer network traffic. Various methods for network data collection are described, focusing especially on the NetFlow protocol. Further, various methods for anomaly detection in network traffic are discussed and evaluated, and their advantages as well as disadvantages are listed. Based on this analysis one method is chosen. Further, test data set is analyzed using the method. Algorithm for real-time network traffic anomaly detection is designed based on the analysis outcomes. This method was chosen mainly because it enables detection of anomalies even in an unlabelled network traffic. The last part of the thesis describes implementation of the algorithm, as well as experiments performed using the resulting application on real NetFlow data.
|
|
|
Network Protection Using NetFlow Data
Czudek, Marek ; Tobola, Jiří (referee) ; Žádník, Martin (advisor)
This thesis deals with the possibility of greater security of network based on NetFlow protocol. Specifically, the detecting network scans based on predefined rules to found this anomaly in the NetFlow data. Next part is the possibility of retrospective data analysis, thereby achieving more accurate detection of attacks on the network. In this work designed application uses predetermined rules to detect the scans and then looks the flows towards the ports witch are protected by the application and than compares with detected scans. In this way, more accurate detection of attacks is achieved.
|
|
|
Network Protection Using NetFlow Data
Czudek, Marek ; Tobola, Jiří (referee) ; Žádník, Martin (advisor)
This thesis deals with the possibility of greater security of network based on NetFlow protocol. Specifically, the detecting network scans based on predefined rules to found this anomaly in the NetFlow data. Next part is the possibility of retrospective data analysis, thereby achieving more accurate detection of attacks on the network. In this work designed application uses predetermined rules to detect the scans and then looks the flows towards the ports witch are protected by the application and than compares with detected scans. In this way, more accurate detection of attacks is achieved.
|
|
|
Detection of Network Anomalies Based on NetFlow Data
Czudek, Marek ; Bartoš, Václav (referee) ; Kořenek, Jan (advisor)
This thesis describes the use of NetFlow data in the systems for detection of disruptions or anomalies in computer network traffic. Various methods for network data collection are described, focusing especially on the NetFlow protocol. Further, various methods for anomaly detection in network traffic are discussed and evaluated, and their advantages as well as disadvantages are listed. Based on this analysis one method is chosen. Further, test data set is analyzed using the method. Algorithm for real-time network traffic anomaly detection is designed based on the analysis outcomes. This method was chosen mainly because it enables detection of anomalies even in an unlabelled network traffic. The last part of the thesis describes implementation of the algorithm, as well as experiments performed using the resulting application on real NetFlow data.
|
guest ::
RSS feed.