Monitoring, Detection and Reporting of Security Incidents in CESNET NREN

BARTOŠ, Václav, Pavel ČELEDA, Tomáš KREUZWIESER, Viktor PUŠ, Petr VELAN a Martin ŽÁDNÍK. Monitoring, Detection and Reporting of Security Incidents in CESNET NREN. 2013.

Základní údaje

Originální název

Monitoring, Detection and Reporting of Security Incidents in CESNET NREN

Autoři

BARTOŠ, Václav, Pavel ČELEDA, Tomáš KREUZWIESER, Viktor PUŠ, Petr VELAN a Martin ŽÁDNÍK

Vydání

2013

---

Další údaje

Jazyk

angličtina

Typ výsledku

Audiovizuální tvorba

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Nizozemské království

Utajení

není předmětem státního či obchodního tajemství

Odkazy

URL

Organizační jednotka

Ústav výpočetní techniky

Klíčová slova anglicky

Monitoring; Anomalies, Security; Incidents; NREN

Příznaky

Mezinárodní význam

---

Anotace

V originále

Network anomalies and incidents are no longer exceptions in current networks. These undesirable activities may influence the network itself or its services. Naturally, the goal of a network operator is to reveal all threatening activities and handle them accordingly. A suitable monitoring infrastructure plays a key role in such a process. The monitoring infrastructure provides informative data about the traffic. An analysis of this data may help revealing anomalies while storage of this data allows to track and diagnose a cause of the observed incidents retrospectively. The presentation deals with a deployment of the research monitoring infrastructure in CESNET2 network. It describes an architecture consisting of metering points as well as of collectors and data analysis. The results demonstrate that the deployed infrastructure provides wide scale insight on the behavior of ingress and egress network traffic.