BTS Internships

Installation and configuration of a traffic analyser to detect DDoS attacks

Denim LATIC ( Promotion: BCYB21 )

Company: Restena

2, place de l’Université, L-4365 Esch-sur-Alzette

Contact: Jo HOFFMANN
Email: jo.hoffmann@restena.lu
Phone: 42 44 091

Description:
Some network anomalies can only be detected by analysing the traffic passing through it.
Technologies like netflow and IPFIX sample traffic passing through network equipment in real time and send aggregate statistics to a central node. Besides storing the data, the central node also evaluates the data along different kinds of parameters and metrics.
A project within GEANT has developed such an evaluation tool (NeMo) with a focus on detecting DDoS attacks.
The aim of this project is to evaluates NeMo with regards to anomaly and DDoS attack detection. While the first stages of the project will be concerned with implementation and configuration of the tool, subsequent stages will dive into the use-case of anomaly detection, and integration of the tool into the incident response ecosystem at Restena.

Tools:
• Installation of solution in Restena LAB environment
• Configuration and integration with netflow/sflow sources
• DDoS attack generation and detection
• General network flow analysis capabilities and anomaly detection
• Integration into Restena's incident handling process
• Time permitting evaluation of extensibility and integration with other tools such as OTRS, Firewall on Demand, ELK...

Period: 1680480000 – 1687478400

Tutor: Marc LUDWIG