|
|
Automated Processing of Log Files in BeeeOn System
Beňo, Marek ; Krobot, Pavel (referee) ; Vampola, Pavel (advisor)
The paper concerns with processing of log files from server applications . System architecture is based on study of availible technologies . Firstly , design of unified log format and impelementation of unified logger library is described . Secondly , installation and configuration of used technologies and their integration is described . The result is log processing system designed to be scalable in the future . System was tested and integrated into project BeeeOn .
|
|
|
Detection of Cyber Attacks in Local Networks
Sasák, Libor ; Gerlich, Tomáš (referee) ; Malina, Lukáš (advisor)
This bachelor thesis focuses on the detection of attacks in the local network and the use of open source tools for this purpose. The first chapter deals with cyber attacks and also describes some of them. The second chapter focuses primarily on intrusion detection systems in general and also mentions and describes some open source systems. The third chapter briefly deals with the general division of attack detection methods. The fourth chapter introduces and describes the selected tool Suricata, which is also tested in the fifth chapter in the detection of various attacks, during which the behaviour and output of this tool are tracked. In the sixth chapter, the ARPwatch tool is presented and tested for ARP spoofing attack detection. The seventh and eighth chapters deal with the design and successful implementation of an attack detection system that provides output in the form of logs indicating malicious or suspicious traffic on the network. The ninth chapter deals with the design and implementation of the application with a graphical user interface, which clearly presents the mentioned logs and also allows other operations, including the essential control of the detection tools.
|
|
|
Development of correlation rules for detecting cyber attacks
Dzadíková, Slavomíra ; Safonov, Yehor (referee) ; Martinásek, Zdeněk (advisor)
The diploma thesis deals with the problem of efficient processing of log records and their subsequent analysis using correlation rules. The goal of the thesis was to implement log processing in a structured form, extract individual log fields using a natural language processing model by solving a question answering problem, and develop correlation rules for detecting malicious behavior. Two datasets were produced during the task solution, one with records from Windows devices, and the other containing records from the Fortigate firewall. Pre-trained models based on the BERT and XLNet architecture were created and trained to solve the log parsing problem using the produced datasets, and the results were analyzed and compared. The second part of the thesis was devoted to the development of correlation rules, where the concept of a generic Sigma notation was investigated. It was developed, successfully tested and deployed six correlation rules into own experimental environment in Elastic Stack system. Each rule is also described by tactics, techniques and sub-techniques of the MITRE ATT&CK framework.
|
|
|
Support for Dynamic Config Reload Inside Rsyslog
Lakatos, Attila ; Češka, Milan (referee) ; Rogalewicz, Adam (advisor)
Logy sú jedným z najcennejších aktív, pokiaľ ide o správu IT systému a monitoring. Keďže zaznamenávajú každú činnosť, ktorá sa uskutočnila na stroji, logy poskytujú prehľad správ- covi systému aby vedel zistiť pôvod problémov, ktoré môžu ovplyvniť výkon, súlad a bezpečnosť. Z tohto dôvodu je možné softvérový nástroj rsyslog použiť, keďže ponúka možnosť prijímať vstupy zo širokej škály zdrojov, transformovať ich a odosielať výsledky rôznym destináciám na základe súboru pravidiel. Jedným z nedostatkov tohto softvéru v súčasnosti je to, že ho je potrebné reštartovať, aby akceptoval aktualizované zmeny v pravidlách. Autor tejto diplomovej práce poukazuje na to, s akými typmi problémov sa môže stretnúť užívateľ počas reštartu nástroja. Medzi najkritickejšie patria strata správ vstupujúcich do systému a narušenie TCP/UDP spojenia, aj keď neboli vykonané žiadne zmeny v pravidlách. Cieľom diplomovej práce je navrhnúť a implementovať riešenie, ktoré umožňuje používateľom dynamicky znovu načítať konfiguráciu základných komponentov bez potreby úplného reštartu. Navrhované zmeny sú zamerané aj na riešenie problémov, ktoré boli odhalené počas vývoja ako aj na zvýšenie výkonu opätovným použitím už exis- tujúcich zdrojov.
|
|
|
Enhancing Security Monitoring with AI-Enabled Log Collection and NLP Modules on a Unified Open Source Platform
Safonov, Yehor ; Zernovic, Michal
The number of computer attacks continues to increasedaily, posing significant challenges to modern securityadministrators to provide security in their organizations. Withthe rise of sophisticated cyber threats, it is becoming increasinglydifficult to detect and prevent attacks using traditional securitymeasures. As a result, security monitoring solutions such asSecurity Information and Event Management (SIEM) have becomea critical component of modern security infrastructures. However,these solutions still face limitations, and administrators areconstantly seeking ways to enhance their capabilities to effectivelyprotect their cyber units. This paper explores how advanced deeplearning techniques can help boost security monitoring capabilitiesby utilizing them throughout all stages of log processing. Thepresented platform has the potential to fundamentally transformand bring about a significant change in the field of securitymonitoring with advanced AI capabilities. The study includes adetailed comparison of modern log collection platforms, with thegoal of determining the most effective approach. The key benefitsof the proposed solution are its scalability and multipurposenature. The platform integrates an open source solution andallows the organization to connect any event log sources or theentire SIEM solution, normalize and filter data, and use thisdata to train and deploy different AI models to perform differentsecurity monitoring tasks more efficiently.
|
|
|
Application for collecting security event logs from computer infrastructure
Žernovič, Michal ; Dobiáš, Patrik (referee) ; Safonov, Yehor (advisor)
Computer infrastructure runs the world today, so it is necessary to ensure its security, and to prevent or detect cyber attacks. One of the key security activities is the collection and analysis of logs generated across the network. The goal of this bachelor thesis was to create an interface that can connect a neural network to itself to apply deep learning techniques. Embedding artificial intelligence into the logging process brings many benefits, such as log correlation, anonymization of logs to protect sensitive data, or log filtering for optimization a SIEM solution license. The main contribution is the creation of a platform that allows the neural network to enrich the logging process and thus increase the overall security of the network. The interface acts as an intermediary step to allow the neural network to receive logs. In the theoretical part, the thesis describes log files, their most common formats, standards and protocols, and the processing of log files. It also focuses on the working principles of SIEM platforms and an overview of current solutions. It further describes neural networks, especially those designed for natural language processing. In the practical part, the thesis explores possible solution paths and describes their advantages and disadvantages. It also analyzes popular log collectors (Fluentd, Logstash, NXLog) from aspects such as system load, configuration method, supported operating systems, or supported input log formats. Based on the analysis of the solutions and log collectors, an approach to application development was chosen. The interface was created based on the concept of a REST API that works in multiple modes. After receiving the records from the log collector, the application allows saving and sorting the records by origin and offers the user the possibility to specify the number of records that will be saved to the file. The collected logs can be used to train the neural network. In another mode, the interface forwards the logs directly to the AI model. The ingestion and prediction of the neural network are done using threads. The interface has been connected to five sources in an experimental network.
|
|
|
A Tool for Creating Log Message Patterns
Hanus, Igor ; Janoušek, Vladimír (referee) ; Smrčka, Aleš (advisor)
Cieľom práce je vyvtorenie prenositeľnej webovej aplikácie na spracovanie logov pomocou kombinácie Grok vzorova a regulárnych výrazov, za účelom vytvorenia vzoru pre jednotlivé záznamy logu s možnosťou exportovania do YAML formátu, ktorý je spracovateľný nástrojom Plogchecker. Aplikácia bola implementovaná pomocou JavaScript knižnice React použitím jazyka TypeScript. Spracovanie jednotlivých regulárnych výrazov je riešené pomocou knižnice Oniguruma, ktorá je integrovaná do aplikácie pomocou WebAssembly. Dôvodom použitia Oniguruma knižnice bola nekompatibilita medzi prekladačmi regulárnych výrazov definovanými štandardom ECMAScript a prekladačmi, ktoré sú využívané pre preklad Grok výrazov. Realizacia aplikácie bola podrobená automatizovaným testom a užívateľským testom, s opravou zistených nálezov.
|
|
|
Support for Dynamic Config Reload Inside Rsyslog
Lakatos, Attila ; Češka, Milan (referee) ; Rogalewicz, Adam (advisor)
Logy sú jedným z najcennejších aktív, pokiaľ ide o správu IT systému a monitoring. Keďže zaznamenávajú každú činnosť, ktorá sa uskutočnila na stroji, logy poskytujú prehľad správ- covi systému aby vedel zistiť pôvod problémov, ktoré môžu ovplyvniť výkon, súlad a bezpečnosť. Z tohto dôvodu je možné softvérový nástroj rsyslog použiť, keďže ponúka možnosť prijímať vstupy zo širokej škály zdrojov, transformovať ich a odosielať výsledky rôznym destináciám na základe súboru pravidiel. Jedným z nedostatkov tohto softvéru v súčasnosti je to, že ho je potrebné reštartovať, aby akceptoval aktualizované zmeny v pravidlách. Autor tejto diplomovej práce poukazuje na to, s akými typmi problémov sa môže stretnúť užívateľ počas reštartu nástroja. Medzi najkritickejšie patria strata správ vstupujúcich do systému a narušenie TCP/UDP spojenia, aj keď neboli vykonané žiadne zmeny v pravidlách. Cieľom diplomovej práce je navrhnúť a implementovať riešenie, ktoré umožňuje používateľom dynamicky znovu načítať konfiguráciu základných komponentov bez potreby úplného reštartu. Navrhované zmeny sú zamerané aj na riešenie problémov, ktoré boli odhalené počas vývoja ako aj na zvýšenie výkonu opätovným použitím už exis- tujúcich zdrojov.
|
|
|
Development of correlation rules for detecting cyber attacks
Dzadíková, Slavomíra ; Safonov, Yehor (referee) ; Martinásek, Zdeněk (advisor)
The diploma thesis deals with the problem of efficient processing of log records and their subsequent analysis using correlation rules. The goal of the thesis was to implement log processing in a structured form, extract individual log fields using a natural language processing model by solving a question answering problem, and develop correlation rules for detecting malicious behavior. Two datasets were produced during the task solution, one with records from Windows devices, and the other containing records from the Fortigate firewall. Pre-trained models based on the BERT and XLNet architecture were created and trained to solve the log parsing problem using the produced datasets, and the results were analyzed and compared. The second part of the thesis was devoted to the development of correlation rules, where the concept of a generic Sigma notation was investigated. It was developed, successfully tested and deployed six correlation rules into own experimental environment in Elastic Stack system. Each rule is also described by tactics, techniques and sub-techniques of the MITRE ATT&CK framework.
|
|
|
Detection of Cyber Attacks in Local Networks
Sasák, Libor ; Gerlich, Tomáš (referee) ; Malina, Lukáš (advisor)
This bachelor thesis focuses on the detection of attacks in the local network and the use of open source tools for this purpose. The first chapter deals with cyber attacks and also describes some of them. The second chapter focuses primarily on intrusion detection systems in general and also mentions and describes some open source systems. The third chapter briefly deals with the general division of attack detection methods. The fourth chapter introduces and describes the selected tool Suricata, which is also tested in the fifth chapter in the detection of various attacks, during which the behaviour and output of this tool are tracked. In the sixth chapter, the ARPwatch tool is presented and tested for ARP spoofing attack detection. The seventh and eighth chapters deal with the design and successful implementation of an attack detection system that provides output in the form of logs indicating malicious or suspicious traffic on the network. The ninth chapter deals with the design and implementation of the application with a graphical user interface, which clearly presents the mentioned logs and also allows other operations, including the essential control of the detection tools.
|
guest ::
