|
| |
|
|
Analysis of Network Security Alerts
Dobeš, Erik ; Žádník, Martin (referee) ; Wrona, Jan (advisor)
The goal of this work is to find groups of IP addresses in network security reports, which were detected in the same, or very similar, time interval. The work introduces an algorithm, which transforms data from security reports into time series. Between all the time series, similar pairs are searched. Subsequently, in the found pairs, we are looking for similar threesomes, in which we try to find similar foursomes, etc. The created solution successfully found 208 similar groups in the set of analyzed data, the largest of which contains 11 similar IP addresses. Based on the data found it is possible to detect machines that are part of the so-called botnet in network security reports.
|
|
|
Aggregation of Security Incident Reports
Kapičák, Daniel ; Kováčik, Michal (referee) ; Bartoš, Václav (advisor)
In this thesis, I present analysis of security incident reports in IDEA format from Mentat and their aggregation and correlation methods design and implementation. In data analysis, I show huge security reports diversity. Next, I show design of simple framework and system of templates. This framework and system of templates simplify aggregation and correlation methods design and implementation. Finally, I evaluate designed methods using Mentat database dumps. The results showed that designed methods can reduce the number of security reports up to 90% without loss of any significant information.
|
|
| |
|
|
Analysis of Network Security Alerts
Dobeš, Erik ; Žádník, Martin (referee) ; Wrona, Jan (advisor)
The goal of this work is to find groups of IP addresses in network security reports, which were detected in the same, or very similar, time interval. The work introduces an algorithm, which transforms data from security reports into time series. Between all the time series, similar pairs are searched. Subsequently, in the found pairs, we are looking for similar threesomes, in which we try to find similar foursomes, etc. The created solution successfully found 208 similar groups in the set of analyzed data, the largest of which contains 11 similar IP addresses. Based on the data found it is possible to detect machines that are part of the so-called botnet in network security reports.
|
|
| |
|
|
Aggregation of Security Incident Reports
Kapičák, Daniel ; Kováčik, Michal (referee) ; Bartoš, Václav (advisor)
In this thesis, I present analysis of security incident reports in IDEA format from Mentat and their aggregation and correlation methods design and implementation. In data analysis, I show huge security reports diversity. Next, I show design of simple framework and system of templates. This framework and system of templates simplify aggregation and correlation methods design and implementation. Finally, I evaluate designed methods using Mentat database dumps. The results showed that designed methods can reduce the number of security reports up to 90% without loss of any significant information.
|
guest ::
