Přehled o publikaci

To complement traditional mechanisms for protection of computer networks, we develop, test and deploy tools based on IP flows monitoring. This technology is built on stand-alone probes that observe network traffic at critical points of network infrastructure. The probes are designed to process multigigabit traffic without any loss and provide network flow statistics for further analysis and attack detection as well as execute deep packet inspection. The probes can be connected in "in-line" mode and filter out objectionable traffic and even counterattack against the attacker. Our research is also focused on network behaviour analysis that scales well in contrast to deep packet inspection. We create software prototypes that are thoroughly tested in the campus network of Masaryk University. Selected prototypes are then tranferred to the university spin-off company. Thanks to security monitoring of the network, we discovered a new botnet for embedded devices named Chuck Norris. Last but not least, we cooperate with Czech Army Computer Incident Response Capability team. They adopts the results of the research and provide valuable feedback from the real environment.