Postupci za korelaciju sigurnosnih uzbuna

undergraduate thesis

• Title (english): Methods for correlation of security alerts
• Author: Ivana Križić
• Mentor: Ante Đerek (mentor)
• Committee member: Ante Đerek (predsjednik povjerenstva)
• Committee member: Martin Tutek (član povjerenstva)
• Committee member: Ivan Kovačević (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2019-07-12, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Sustavi za otkrivanje napada (eng. Intrusion Detection Systems - IDS) nadziru mrežni promet te kada otkriju potencijalno zlonamjernu aktivnost izdaju sigurnosnu uzbunu. Problem upravljanja velikom količinom sigurnosnih uzbuna rješava se postupcima za korelaciju. Unutar ovog rada razvili smo sustav za korelaciju sigurnosnih uzbuna s ciljem otkrivanja sličnosti i uzročno-posljedičnih veza među uzbunama što je rezultiralo jasnijom slikom stanja računalnog sustava. Razvijeni sustav sastoji se od komponente agregacije sigurnosnih uzbuna u strukturne obrasce i komponente za pronalaženje često pojavljivanih strukturnih obrazaca unutar nadzirane mreže. Sustav je testiran na javno dostupnim skupovima podataka DARPA 2000 i CICIDS2017 koji u sebi sadrže primjere scenarija mrežnih napada.

Abstract (english)

Intrusion detection systems monitor network traffic and issue security alert when they detect potentially malicious activity. The problem of managing a large amount of security alerts is solved by using correlation methods. In this paper, we have developed a system for correlating security alerts which incorporates detecting similarities and causal relationships between the alerts and results in a clearer picture of the state of the computer system. The developed system consists of a component which aggregates security alerts in structural patterns and component for finding frequently seen structural patterns within the supervised network. The system was tested on publicly available datasets DARPA 2000 and CICIDS2017, which include examples of network attack scenarios.

• Keywords: mrežna sigurnost; sigurnosne uzbune; mrežni napadi; korelacija sigurnosnih uzbuna; DDoS napad
• Keywords (english): network security; alerts; network intrusion; alert correlation; DDoS attack
• Language: croatian
• URN:NBN: urn:nbn:hr:168:243385
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2020-01-07 19:25:44