|
|
Prostředí pro funkční verifikaci multi-sběrnic podle UVM standardu
Beneš, Tomáš ; Šišmiš, Lukáš (oponent) ; Kekely, Lukáš (vedoucí práce)
Práce se zabývá návrhem a následnou implementací prostředí pro verifikace multi-sběrnic s využitím principů univerzální verifikační metodologie (UVM). Dále se zabývá implementací verifikací tří FPGA konkrétních komponent využívající multi-sběrnice jako vstupní a výstupní rozhraní. Implementace prostředí i všech verifikací je napsaná v jazyce SystemVerilog s využitím knihovny implementující základní konstrukce pro UVM. Dosažené výsledky práce jsou funkční a jednoduše znovupoužitelné při tvorbě dalších verifikací využívající multi-sběrnic. Navržené prostředí se dají využít jako struktura pro tvorbu dalších verifikačních prostředí pro jiné sběrnice.
|
|
|
Evaluation of rte_flow Network Interface Cards Support
Šuráň, Jakub ; Fukač, Tomáš (oponent) ; Šišmiš, Lukáš (vedoucí práce)
The support of the classifier interface rte_flow significantly differs across various network cards. This bachelor's thesis deals with the process of evaluation of this support. The main goal is to provide tools that can perform evaluation systematically and automatically. Two approaches are used for this purpose. The first one is based on the progressive loading of rte_flow rules into the network card and the collection of supported capabilities from the successful attempts. The results are used for the final summary generation. The second approach verifies that particular rules indeed have expected effects on the packets processed by card. Each of these approaches was then transformed into an executable tool. Both were applied and validated on several network cards by the Intel and NVIDIA manufacturers. Simultaneously, their produced outputs were utilized for the mutual comparison of rte_flow interface support between these network cards.
|
|
|
Optimization of the Suricata IDS/IPS
Šišmiš, Lukáš ; Fukač, Tomáš (oponent) ; Korček, Pavol (vedoucí práce)
The recent rapid increase of network traffic bandwidth has sprung new challenges in securing the network. It is vital to keep monitoring the traffic to securely identify threats in the network. Systems like IDS (intrusion detection systems) alert us about events in the analyzed traffic. Suricata , as one of the available IDS, was chosen for this thesis. The ultimate goal of the thesis is to tune settings of AF_PACKET capture interface to reach the best performance possible and then suggest and implement an optimization for Suricata . Results of the AF_PACKET should be used as a baseline for comparison with future improvements. Optimization is based on implementing a new capture interface to Suricata that is based on Data Plane Development Kit ( DPDK ). DPDK helps to accelerate packet capture and this implies that it might improve the performance of Suricata . Results that compare AF_PACKET and DPDK performance are evaluated at the end of this master thesis.
|
|
|
Integrace senzorů a aktorů do systému BeeeOn
Šišmiš, Lukáš ; Korček, Pavol (oponent) ; Sakin, Martin (vedoucí práce)
Cieľom tejto práce bolo rozšíriť systém BeeeOn o modul Vektiva a preskúmať možnosti implementovania produktu Smarwi do systému BeeeOn, čo zahŕňalo nielen štúdium komunikačných protokolov, ktoré zariadenie používa ale aj ich porovnanie a výber vhodného protokolu pre implementáciu. Na začiatku práce je popísaný BeeeOn systém a jeho komponenty, na ktorý následne nadväzuje popis procesu implementácie a testovania Vektiva modulu a aj Smarwi emulátoru.
|
|
|
Graf řízení toku programů v jazyce P4
Ponek, Timotej ; Šišmiš, Lukáš (oponent) ; Kekely, Lukáš (vedoucí práce)
Koncept SDN sa postupne stal jedným z najpopulárnejších riešení správy sietí. Umožňuje rýchlu rekonfigurovateľnosť sieťových zariadení tak, aby odrážala aktuálne požiadavky a taktiež umožňovala rýchle testovanie nových riešení. Týmto podporuje pokrok v sieťovej oblasti. Táto práca sa venuje jazyku P4, ktorý je jednou z implementácií konceptu SDN. Prínosom práce je zlepšenie časti existujúceho open-source prekladača jazyka P4, ktorá slúži na generovanie grafov riadenia toku programu. Nová implementácia zachytáva tok programu aj vo vnútri tabuliek a akcií, čo umožňuje ľahšie kontrolovať výstup prekladu a ďalej optimalizovať prekladač pre potreby redukcie mŕtveho kódu. Taktiež poskytuje možnosť generovať fullgraf vo formáte dot a preddefinovanom json formáte, ktorý zachytáva tok programu naprieč všetkými funkčnými blokmi daného P4 programu.
|
|
|
DDoS Mitigation Configuration Tool
Beneš, Dalibor ; Vrána, Roman (oponent) ; Šišmiš, Lukáš (vedoucí práce)
Distributed Denial of Service (DDoS) attacks are a common security concern for computer networks and the services using them. One of the forms of defence is to use the DCPro DDoS Protector device developed by the CESNET association. The DDoS Protector actively mitigates ongoing attacks aimed at the protected network. The mitigation device is configurable using so-called mitigation rules. The goal of this work was to design and implement a command-line configuration tool for the DDoS Protector. A part of this work involved the creation of a reusable configuration API in Python. The configuration tool was implemented in Python using the API. It has been tested and successfully deployed as a part of the DCPro DDoS Protector package.
|
|
|
Using Metadata to Optimize the Suricata IDS/IPS
Shchapaniak, Andrei ; Fukač, Tomáš (oponent) ; Šišmiš, Lukáš (vedoucí práce)
As the Internet continues to grow and evolve, cyber-attacks have become more harmful and severe. Therefore, it is important to have effective detection and prevention systems. The need for such systems is becoming more demanding because the damage caused by cyber-attacks can be devastating to individuals and organizations. This motivates the development of high-performance detection and prevention systems that are able to detect and prevent cyber-attacks in a more effective way. Specifically, this thesis is focused on one of such systems -- Suricata. It is an open-source IDS/IPS system that is widely used in the industry due to its advanced capabilities and flexibility. The ultimate goal of the thesis is to design, implement and evaluate the transmission of per-packet metadata. Metadata could be added by smart network interface cards (SmartNICs). DPDK Prefilter was used in conjunction with Suricata to simulate the specialized hardware. It can simulate the transmission of metadata to Suricata. The impact of metadata and the results of the experimental evaluation will be discussed in detail at the end of this bachelor's thesis.
|
|
|
Prostředí pro funkční verifikaci multi-sběrnic podle UVM standardu
Beneš, Tomáš ; Šišmiš, Lukáš (oponent) ; Kekely, Lukáš (vedoucí práce)
Práce se zabývá návrhem a následnou implementací prostředí pro verifikace multi-sběrnic s využitím principů univerzální verifikační metodologie (UVM). Dále se zabývá implementací verifikací tří FPGA konkrétních komponent využívající multi-sběrnice jako vstupní a výstupní rozhraní. Implementace prostředí i všech verifikací je napsaná v jazyce SystemVerilog s využitím knihovny implementující základní konstrukce pro UVM. Dosažené výsledky práce jsou funkční a jednoduše znovupoužitelné při tvorbě dalších verifikací využívající multi-sběrnic. Navržené prostředí se dají využít jako struktura pro tvorbu dalších verifikačních prostředí pro jiné sběrnice.
|
|
|
Evaluation of rte_flow Network Interface Cards Support
Šuráň, Jakub ; Fukač, Tomáš (oponent) ; Šišmiš, Lukáš (vedoucí práce)
The support of the classifier interface rte_flow significantly differs across various network cards. This bachelor's thesis deals with the process of evaluation of this support. The main goal is to provide tools that can perform evaluation systematically and automatically. Two approaches are used for this purpose. The first one is based on the progressive loading of rte_flow rules into the network card and the collection of supported capabilities from the successful attempts. The results are used for the final summary generation. The second approach verifies that particular rules indeed have expected effects on the packets processed by card. Each of these approaches was then transformed into an executable tool. Both were applied and validated on several network cards by the Intel and NVIDIA manufacturers. Simultaneously, their produced outputs were utilized for the mutual comparison of rte_flow interface support between these network cards.
|
|
|
DDoS Mitigation Configuration Tool
Beneš, Dalibor ; Vrána, Roman (oponent) ; Šišmiš, Lukáš (vedoucí práce)
Distributed Denial of Service (DDoS) attacks are a common security concern for computer networks and the services using them. One of the forms of defence is to use the DCPro DDoS Protector device developed by the CESNET association. The DDoS Protector actively mitigates ongoing attacks aimed at the protected network. The mitigation device is configurable using so-called mitigation rules. The goal of this work was to design and implement a command-line configuration tool for the DDoS Protector. A part of this work involved the creation of a reusable configuration API in Python. The configuration tool was implemented in Python using the API. It has been tested and successfully deployed as a part of the DCPro DDoS Protector package.
|
host ::
RSS.