|
|
DNS Amplification Attack Detection Using Passive DNS Analysis
Míšaný, Daniel ; Bartoš, Václav (referee) ; Kováčik, Michal (advisor)
This thesis is focused on the analysis and detection of DNS Amplification attack which is type of the DoS attack. Introduction of this thesis is focused on fundamental theories involving computer networks, DNS and DoS attacks. The main part of the work deals with the analysis of DNS Amplification attack, design and implementation of detection tool in C++ programming language. The conclusion is devoted to analyzing the results of the detection tool.
|
|
| |
|
| |
|
|
Mitigation of DoS Attacks Using Machine Learning
Goldschmidt, Patrik ; Kekely, Lukáš (referee) ; Kučera, Jan (advisor)
Útoky typu odoprenia služby (DDoS) sú v dnešných počítačových sieťach stále frekventovanejším bezpečnostným incidentom. Táto práca sa zameriava na detekciu týchto útokov a poskytnutie relevantných informácii za účelom ich mitigácie v reálnom čase. Spomínaná funkcionalita je dosiahnutá s využitím techník prúdového dolovania z dát a strojového učenia. Výsledkom práce je sada nástrojov zastrešujúca celý proces strojového učenia - od vlastnej extrakcie príznakov cez predspracovanie dát až po export natrénovaného modelu pripraveného na nasadenie v produkcii. Experimentálne výsledky vyhodnotené na viacerých reálnych a syntetických dátových sadách poukazujú na presnosť systému väčšiu ako 99% s možnosťou spoľahlivej detekcie prebiehajúceho útoku do 4 sekúnd od jeho začiatku.
|
|
|
Analysis and Demonstration of Selected Network Attacks
Gregorová, Pavlína ; Trchalík, Roman (referee) ; Očenášek, Pavel (advisor)
In this Bachelor thesis there are described network attacks which focus on network a computers issues. Attacks are aimed at operation system Windows and its security faults. The aim of this Bachelor thesis is also to prepare materials for lab of course called Security and Computer Networks, which is taught at the Faculty of Information Technology in the University of Technology in Brno.
|
|
|
Detection of SYN Flood Attacks
Ruprich, Michal ; Kekely, Lukáš (referee) ; Bartoš, Václav (advisor)
The thesis deals with a topic of anomally detection in network traffic. The goal is to implement three algorithms which will be able to reveal SYN flooding types of network attacks. Used methods monitor network traffic in real time and create certain model of normal traffic behaviour. This model is then used to detect behaviour which does not fit the model and therefore is considered as an anomally. Algorithms were implemented in C and C++ programming languages.
|
|
|
Automated cyber security tester for smart devices in industry
Dávidík, Roland ; Mlýnek, Petr (referee) ; Lieskovan, Tomáš (advisor)
This diploma thesis explains the principle of SCADA systems and describes the DLMS/COSEM protocol. In the next part, it shortly describes the Modbus protocol and details the pros and cons of the Modbus protocol in comparison with the DLMS/COSEM protocol. In the next part, an open-source automated scanner was created. This scanner detects devices in a laboratory network. As the next step, the automated scanner finds out open ports and active services, which run on these devices, and tries to attack HTTP, SSH, and Telnet services. Next, the program checks, whether the found device is a smart-meter device and if it is compatible with DLMS/COSEM protocol. If yes, it checks, if the service is vulnerable to DOS attack and breaker disconnection. Scanner’s findings are presented in a newly created web application. NMAP, Masscan, and Metasploit open-source programs are used in the automated scanner. The whole automated scanner is optimized for the HW device Raspberry Pi with the operating system Raspbian Buster Lite installed. This work also describes the testing of the scanner on the laboratory environment and the results are evaluated afterwards.
|
|
|
Cyber security tester of elements used in industrial networks and energy industry
Březina, Jiří ; Mlýnek, Petr (referee) ; Lieskovan, Tomáš (advisor)
The following is a detailed discussion of the communication protocols that work in these networks, from the older and more industrially based Modbus protocol, through the IEC 60870 protocol suite, to the most commonly used protocol today, DLMS/COSEM. The paper also summarizes the most common current attack patterns on DLMS/COSEM protocol vulnerabilities. The thesis aims to implement a tester that tests the security of smart grid elements mainly on the vulnerabilities described in the thesis. The tester primarily focuses on the vulnerabilities of overwhelm and replay attacks and evaluating the execution of these attacks in a laboratory environment.
|
|
|
Mitigation of DoS Attacks Using Machine Learning
Goldschmidt, Patrik ; Kekely, Lukáš (referee) ; Kučera, Jan (advisor)
Útoky typu odoprenia služby (DDoS) sú v dnešných počítačových sieťach stále frekventovanejším bezpečnostným incidentom. Táto práca sa zameriava na detekciu týchto útokov a poskytnutie relevantných informácii za účelom ich mitigácie v reálnom čase. Spomínaná funkcionalita je dosiahnutá s využitím techník prúdového dolovania z dát a strojového učenia. Výsledkom práce je sada nástrojov zastrešujúca celý proces strojového učenia - od vlastnej extrakcie príznakov cez predspracovanie dát až po export natrénovaného modelu pripraveného na nasadenie v produkcii. Experimentálne výsledky vyhodnotené na viacerých reálnych a syntetických dátových sadách poukazujú na presnosť systému väčšiu ako 99% s možnosťou spoľahlivej detekcie prebiehajúceho útoku do 4 sekúnd od jeho začiatku.
|
|
|
Automated cyber security tester for smart devices in industry
Dávidík, Roland ; Mlýnek, Petr (referee) ; Lieskovan, Tomáš (advisor)
This diploma thesis explains the principle of SCADA systems and describes the DLMS/COSEM protocol. In the next part, it shortly describes the Modbus protocol and details the pros and cons of the Modbus protocol in comparison with the DLMS/COSEM protocol. In the next part, an open-source automated scanner was created. This scanner detects devices in a laboratory network. As the next step, the automated scanner finds out open ports and active services, which run on these devices, and tries to attack HTTP, SSH, and Telnet services. Next, the program checks, whether the found device is a smart-meter device and if it is compatible with DLMS/COSEM protocol. If yes, it checks, if the service is vulnerable to DOS attack and breaker disconnection. Scanner’s findings are presented in a newly created web application. NMAP, Masscan, and Metasploit open-source programs are used in the automated scanner. The whole automated scanner is optimized for the HW device Raspberry Pi with the operating system Raspbian Buster Lite installed. This work also describes the testing of the scanner on the laboratory environment and the results are evaluated afterwards.
|
guest ::
