Demonstracija rada alata za detekciju distribuiranih napada uskrate usluga korištenjem mrežnog simulatora IMUNES

master's thesis

• Title (english): Demonstration of the tool for detecting distributed denial-of-service attacks using the IMUNES network simulator
• Author: Ivan Kezić
• Mentor: Miljenko Mikuc (mentor)
• Committee member: Miljenko Mikuc (predsjednik povjerenstva)
• Committee member: Dragan Jevtić (član povjerenstva)
• Committee member: Marin Vuković (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2022-07-11, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

U ovome radu upoznali smo se s vrstama DDoS napada te je za svaku vrstu naveden i konkretan primjer napada. Budući da su ovakve vrste napada uglavnom zlonamjerne, važno je pravovremeno detektirati te blokirati izvore istih. Jedan od načina kojim je moguće detektirati potencijalni napad jest korištenje alata FastNetMon. Navedeni alat koristi se za detekciju distribuiranih napada uskrate usluga (engl. Distributed Denial of Service) odnosno DDOS napada obradom podataka prikupljenih standardnim protokolima NetFlow, IPFIX ili sFLOW, direktnim dohvaćanjem mrežnog prometa korištenjem sučelja AF_PACKET, radnog okvira Netmap ili PCAP. Alat može detektirati potencijalno zlonamjerni promet u mreži te ga odmah blokirati ili ugrađenim programskim sučeljima signalizirati neželjene pojave. U radu je prikazano kako alat radi unutar mrežnog simulatora IMUNES te njegova integracija s brzim mrežama.

Abstract (english)

In this paper we were introduced to the types of DDoS attacks and for each type a specific example of an attack is given. Since these types of attacks are mostly malicious, it is important to detect and block their sources in a timely manner. One way to detect a potential attack is to use the FastNetMon tool. This tool is used to detect Distributed Denial of Service or DDOS attacks, by processing data collected by standard NetFlow, IPFIX or sFLOW protocols, by directly retrieving network traffic using the AF_PACKET interface, Netmap framework or PCAP. The tool can detect potentially malicious network traffic and immediately block it or signal unwanted occurrences with built-in programming interfaces. The paper presents the operation of the tool in the network simulator IMUNES and its integration in high-speed networks. The paper shows how the tool works within the IMUNES network simulator and its integration with fast networks.

• Keywords: DDoS; IMUNES; FastNetMon
• Keywords (english): DDoS; IMUNES; FastNetMon
• Language: croatian
• URN:NBN: urn:nbn:hr:168:641728
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-14 09:06:29