Stvarnovremeno praćenje i analiza događaja prikupljenih s umreženih čvorova

master's thesis

• Title (english): Real-time monitoring and analysis of events collected from networked nodes
• Author: Karlo Sambolec
• Mentor: Gordan Ježić (mentor)
• Committee member: Gordan Ježić (predsjednik povjerenstva)
• Committee member: Mario Kušek (član povjerenstva)
• Committee member: Ivana Podnar Žarko (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2019-07-11, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Electrical Engineering

Abstract

U velikim mrežama s velikim brojem umreženih čvorova, stvaraju se velike količine podataka. Te podatke moguće je pratiti sustavima za stvarnovremeno praćenje i analizu podataka i događaja. Takvi sustavi također omogućuju prepoznavanje anomalija u radu sustava, sigurnosnih anomalija i ostalih problema koji se mogu pojaviti u sustavu. U ovom radu obrađena su dva sustava za stvarnovremeno praćenje i analizu događaja s umreženih čvorova – Wazuh i Graylog. Opisane su njihove komponente, arhitektura, komunikacija, instalacija i na kraju način rada i korištenja. Zatim je predstavljena mreža nad kojom sustavi provode praćenje te scenariji pomoću kojih se generiraju događaji za analizu. Scenariji prikazuju događaje nedozvoljenog ponašanja korisnika sustava s različitim razinama prava pristupa. Na kraju rada dana je analiza rezultata i usporedba sustava.

Abstract (english)

Large networks with large number of network nodes generate a large amount of data. That data can be tracked by real-time monitoring and event analysis tools. Such tools also allow us to detect anomalies in system operation, security anomalies and other problems which can occur in the system. This thesis describes two of these real-time monitoring and event analysis tools – Wazuh and Graylog. It explains their components, architecture, communication and installation work and how to use them on actual network. After that, Wazuh and Graylog monitoring network is described. Also, it’s described how network is working under normal conditions and under certain scenarios. These scenarios contain description of unauthorized user behavior in cases when users have different levels of access rights. Results of scenarios are analyzed in final chapter and real-time monitoring and event analysis tools are compared.

• Keywords: stvarnovremeno praćenje; analiza događaja; umreženi čvorovi; Wazuh; Graylog
• Keywords (english): real-time monitoring; event analysis; networked nodes; Wazuh; Graylog
• Language: croatian
• URN:NBN: urn:nbn:hr:168:855653
• Study programme: Title: Information and Communication Technology; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka informacijske i komunikacijske tehnologije (magistar/magistra inženjer/inženjerka informacijske i komunikacijske tehnologije)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2020-01-07 21:55:32