|
|
Web application for displaying cyber attacks in local networks
Matušicová, Viktória ; Mikulec, Marek (oponent) ; Safonov, Yehor (vedoucí práce)
The information sphere is constantly and rapidly developing. This expansion means an increase in the risks of the Internet use. Vulnerabilities and other threats are emerging that provide an opportunity for unauthorized users to penetrate the integrity of protected infrastructures. The main goal of the bachelor’s thesis is to create a tool that allows the system administrator to perform the analysis of end stations in the local network. With the help of the web application, the administrator is able to view all computer attacks performed on his computer infrastructure. That makes it possible for him to implement countermeasures which will improve performance and security of the entire infrastructure. From a theoretical point of view, the bachelor thesis is focused on the issue of computer attacks on the data layer and network layer of the ISO/OSI model. Subsequently, it is focused on the structure of workplace involvement and web application. In the last part the work is focused on the design of the web application and its integration into the experimental workplace. Emphasis during the practical part is placed on the implementation of the workplace and web application on the local network. The practical part is divided into two implementation groups. Initially the experimental workplace is implemented within the local network. Here the web application focuses on the development of the server side – working with databases. In the second phase of implementation the experimental workplace is transferred into a real form. Following application features are added: various graphical displays, filtering and a section for user settings. Large emphasis is placed onto the security of the entire application – login system, server and client configuration settings. After the experimental workplace is connected with the web application, the functionality of the entire solution is tested by three different computer attacks. At the end of the thesis a brief conclusion and summary of the bachelor’s thesis is established.
|
|
|
Web application for generalizing SIEM correlation rules
Matušicová, Viktória ; Mikulec, Marek (oponent) ; Safonov, Yehor (vedoucí práce)
The risk of attacks on companies by organized crime increases as technology advances. Attacks that focus on modifying data or gaining access to a company's network are constantly developed. The sophisticated nature of advanced threats distinguishes them from broad-based attacks that rely on automated scripts. However, organizations can mitigate this risk by utilizing a combination of appropriate tools. These include network flow monitoring, probes for detecting and preventing attacks, and Security Information and Event Management (SIEM) tools for correlating incidents and events. By leveraging these tools, suspicious behavior in the network can be identified, and measures can be taken to prevent and mitigate the impact of cyber attacks. The main contribution of this thesis is the development of a web application that serves as a general tool for managing correlation rules across various SIEM solutions. Through the use of this web application, publicly available Sigma rules can be managed and converted into target SIEM solutions. Users are given the ability to save these rules to their personal user section, alongside SIEM conversions and visual representations of technique coverage based on categorization by MITRE ATT@CK and LogSource of stored user rules. The theoretical part of the thesis comprises an analysis of security monitoring issues, an explanation of the benefits of the Sigma platform and an analysis of the web application. A use case model is defined, functional and non-functional requirements are specified to describe the resulting system. Additionally, the analysis of available tools for converting Sigma rules is performed. The practical portion of the thesis begins with a focus on the design of the web application, including the architecture of both the server-side and client-side components, as well as an explanation of the core functionalities. The resulting solution is then implemented, with detailed procedures for creating microservices, client-side development, and launching the web application. The final state of the project summarizes the result. The thesis concludes with a testing phase, the client side of the web application is evaluated through functional user interface screenshots. The thesis also includes a demonstration of the process for testing Sigma rules, which involves converting the rules using the web application and subsequently carrying out functional verification using the RSA NetWitness SIEM test solution.
|
|
|
Web application for displaying cyber attacks in local networks
Matušicová, Viktória ; Mikulec, Marek (oponent) ; Safonov, Yehor (vedoucí práce)
The information sphere is constantly and rapidly developing. This expansion means an increase in the risks of the Internet use. Vulnerabilities and other threats are emerging that provide an opportunity for unauthorized users to penetrate the integrity of protected infrastructures. The main goal of the bachelor’s thesis is to create a tool that allows the system administrator to perform the analysis of end stations in the local network. With the help of the web application, the administrator is able to view all computer attacks performed on his computer infrastructure. That makes it possible for him to implement countermeasures which will improve performance and security of the entire infrastructure. From a theoretical point of view, the bachelor thesis is focused on the issue of computer attacks on the data layer and network layer of the ISO/OSI model. Subsequently, it is focused on the structure of workplace involvement and web application. In the last part the work is focused on the design of the web application and its integration into the experimental workplace. Emphasis during the practical part is placed on the implementation of the workplace and web application on the local network. The practical part is divided into two implementation groups. Initially the experimental workplace is implemented within the local network. Here the web application focuses on the development of the server side – working with databases. In the second phase of implementation the experimental workplace is transferred into a real form. Following application features are added: various graphical displays, filtering and a section for user settings. Large emphasis is placed onto the security of the entire application – login system, server and client configuration settings. After the experimental workplace is connected with the web application, the functionality of the entire solution is tested by three different computer attacks. At the end of the thesis a brief conclusion and summary of the bachelor’s thesis is established.
|
host ::
RSS.