Automatizacija odziva sigurnosnog sustava umreženih vatrozida

master's thesis

• Title (english): Automation of network firewall response system
• Author: Luka Cigula
• Mentor: Željko Ilić (mentor)
• Committee member: Željko Ilić (predsjednik povjerenstva)
• Committee member: Gordan Šišul (član povjerenstva)
• Committee member: Adrian Satja Kurdija (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2024-07-02, Croatia

Abstract

Rad je fokusiran na problematiku automatizacije kreacije pravila na vatrozidima u sustavima zaštite kibernetičkog prostora. Kako ručno upravljanje pravilima vatrozida postaje neefikasno te sklono pogreškama, u radu je predstavljeno rješenje automatizacije pravila. Korištene su tehnologije za skupljanje i obradu dnevničkih zapisa poput Elasticsearcha i ElastAlerta2 te je kroz Python3 programski jezik implementiran sustav za kreaciju pravila na Palo Alto vatrozidima. Ovakva integracija omogućava brzu reakciju na prijetnje te značajno smanjuje potrebu za ručnim intervencijama, što kao rezultat ima povećanje kvalitete i brzine sigurnosnog odziva čitavog sustava.

Abstract (english)

The paper focuses on the issue of automating the creation of firewall rules in cyber defense systems. As manual management of firewall rules becomes inefficient and prone to errors, the paper presents a solution for rule automation. Technologies for collecting and processing log records, such as Elasticsearch and ElastAlert2, were used. A system for creating rules on Palo Alto firewalls was implemented through the Python3 programming language. This integration enables a swift response to threats and significantly reduces the need for manual interventions, resulting in increased quality and speed of the overall system's security response.

• Keywords: vatrozid; demilitarizirana zona; topologija mreže; SIEM; Elasticsearch; ElastAlert2; upozoravanje
• Keywords (english): firewall; demilitarized zone; network topology; SIEM; Elasticsearch; ElastAlert2; alerting
• Language: croatian
• URN:NBN: urn:nbn:hr:168:468158
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2024-10-12 20:17:09