FI:PV210 Network Traffic Analysis - Course Information

PV210 Security analysis of network traffic

Extent and Intensity

2/1/0. 3 credit(s) (plus extra credits for completion). Type of Completion: k (colloquium).

Teacher(s)

doc. RNDr. Jan Vykopal, Ph.D. (lecturer)
doc. Ing. Pavel Čeleda, Ph.D. (lecturer)
RNDr. Martin Drašar, Ph.D. (lecturer)
RNDr. Tomáš Jirsík, Ph.D. (lecturer)
RNDr. Daniel Kouřil, Ph.D. (lecturer)
RNDr. Michal Procházka, Ph.D. (lecturer)
RNDr. Petr Velan, Ph.D. (lecturer)

Guaranteed by

doc. RNDr. Vlastislav Dohnal, Ph.D.
Department of Computer Systems and Communications – Faculty of Informatics
Contact Person: doc. RNDr. Jan Vykopal, Ph.D.
Supplier department: Department of Computer Systems and Communications – Faculty of Informatics

Timetable

Tue 10:00–11:50 C416

• Timetable of Seminar Groups:

PV210/01: each odd Thursday 8:00–9:50 B116, M. Drašar, T. Jirsík, D. Kouřil, M. Procházka, P. Velan, J. Vykopal
PV210/02: each even Thursday 8:00–9:50 B116, M. Drašar, T. Jirsík, D. Kouřil, M. Procházka, P. Velan, J. Vykopal

Prerequisites (in Czech)

(( MB104 Mathematics || MV011 Statistics I ) && ( PB156 Computer Networks || PV183 Computer Networks Technology ) ) || SOUHLAS

Course Enrolment Limitations

The course is also offered to the students of the fields other than those the course is directly associated with.
The capacity limit for the course is 30 student(s).
Current registration and enrolment status: enrolled: 0/30, only registered: 0/30, only registered with preference (fields directly associated with the programme): 0/30

fields of study / plans the course is directly associated with

there are 39 fields of study the course is directly associated with, display

Course objectives

The lecture deals with methods and tools for security analysis of network traffic. Mathematical and visualisation methods processing aggregated characteristics of TCP/IP data are introduced as well as simple but useful methods. Apart from traffic volume quantities, the primary focus will be on IP traffic flows with emphasis on network security. We are aimed at high-speed networks. The studied methods will be illustrated on traffic samples from the Masaryk university network.
At the end of the course student should be able to:
understand the structure of data on local network and its edge;
understand basic methods for analysis of traffic and use relevant tools;

Syllabus

• Fundamentals of TCP/IP communication and application protocols.
• Network attacks and network layers. Network security devices: IDS/IPS, antispam filter, antivirus.
• Basics of network monitoring: packets, IP data flows, measurement methods, tools for their analysis and visualisation.
• Simple and advanced methods proccessing IP flow data. Traffic volume quantities, time-series analysis, prediction methods. Distribution of key items of IP flows (addresses and ports) in traffic samples: entropy and principal component analysis. Overview of available implementations.

Literature

• Quittek J. et al. Requirements for IP Flow Information Export (IPFIX). RFC 3917, IETF, 2004.
• SANS: The Top Cyber Security Risks. http://www.sans.org/top-cyber-security-risks
• Bellovin, S. M. Security problems in the TCP/IP protocol suite.
• Scarfone, K. Mell, P.: Guide to Intrusion Detection and Prevention Systems (IDPS). Recommendations of the National Institute of Standards and Technology, 2007.
• Brutlag, J.: Aberrant behaviour Detection in Time Series for Network Monitoring, 2000
• Lakhina A., Crovella M., Diot C. Mining anomalies using traffic feature distributions. In: Proc. ACM SIGCOMM'05, p. 217-228, 2005.

Teaching methods

Lectures including class discussion, homeworks, seminars in computer lab.

Assessment methods

Homeworks during the semester, written test and discussion (colloquium).

Language of instruction

Czech

Further Comments

Study Materials
The course is taught annually.

• Enrolment Statistics (Autumn 2013, recent)
  
• Permalink: https://is.muni.cz/course/fi/autumn2013/PV210