|
|
Optimization of Distributed Network Flow Collector
Wrona, Jan ; Grégr, Matěj (referee) ; Žádník, Martin (advisor)
This thesis is focused on the optimization of distributed IP flow information collector. Nowadays, the centralized collector is a frequently used solution but is already reaching its performance limits in large scale and high-speed networks. The implementation of the distributed collector is in its early phase and it is necessary to look for solutions that will use it to its full potential. Therefore this thesis proposes a shared nothing architecture without a single point of failure. Using the above proposed architecture, the distributed collector is tolerant to the failure of at least one node. A distributed flow data analysis software, whose performance scales linearly with the number of nodes, is also part of this thesis.
|
|
|
Analysis of Captured DNS Traffic
Hmeľár, Jozef ; Kekely, Lukáš (referee) ; Kováčik, Michal (advisor)
This thesis is focused on the analysis of captured DNS traffic. Introduction of this thesis is focused of basic desciption of computer networks , DNS and description of network flows. Then, the work focused on analysis Netflow format, IPFIX and PCAP, the analysis and implementation of tool for analyzing DNS traffic in C++ programming language. The conclusion is devoted to the results of the implemented tools.
|
|
|
Distributed Tool for Extraction of Information from Network Flows
Sedlák, Michal ; Grégr, Matěj (referee) ; Žádník, Martin (advisor)
This work deals with the extraction of information from flow records that are the result of network monitoring by the IPFIX system. The goal of the work is to design a tool that allows querying stored network flows created by the open-source collector IPFIXcol2. Querying is performed with the highest possible efficiency and performance in mind, which is achieved by using appropriate data structures and thread-level parallelization, as well as by using multiple machines.
|
|
|
Detection of Malware Communication in Network Flows
Korvas, Václav ; Matoušek, Petr (referee) ; Ryšavý, Ondřej (advisor)
This thesis deals with the issue of network communication of malicious code, methods of their analysis and especially the comparison of accuracy of different machine learning algorithms among themselves. The paper presents a comparison of the accuracy of different machine learning algorithms, both on test data and when used in real life. Accuracy, F1-score and false positive rate were used as metrics to evaluate the results. On the test data, the Random Forest and XGBoost algorithms were found to be the most accurate, achieving 99.2% accuracy with a rate of false positivity of 0.6%. In real-life experiments, approximately 9% of flows were incorrectly detected and classified as malware. When the computer was compromised, the rate of flows classified as malware increased to 18%, and several indicators of compromise were captured and confirmed the infection of the computer.
|
|
|
Optimization of Distributed Network Flow Collector
Wrona, Jan ; Grégr, Matěj (referee) ; Žádník, Martin (advisor)
This thesis is focused on the optimization of distributed IP flow information collector. Nowadays, the centralized collector is a frequently used solution but is already reaching its performance limits in large scale and high-speed networks. The implementation of the distributed collector is in its early phase and it is necessary to look for solutions that will use it to its full potential. Therefore this thesis proposes a shared nothing architecture without a single point of failure. Using the above proposed architecture, the distributed collector is tolerant to the failure of at least one node. A distributed flow data analysis software, whose performance scales linearly with the number of nodes, is also part of this thesis.
|
|
|
Analysis of Captured DNS Traffic
Hmeľár, Jozef ; Kekely, Lukáš (referee) ; Kováčik, Michal (advisor)
This thesis is focused on the analysis of captured DNS traffic. Introduction of this thesis is focused of basic desciption of computer networks , DNS and description of network flows. Then, the work focused on analysis Netflow format, IPFIX and PCAP, the analysis and implementation of tool for analyzing DNS traffic in C++ programming language. The conclusion is devoted to the results of the implemented tools.
|
guest ::
