BTS Internships

Mise en place d'une solution d'analyse de log de sécurité

Nelson André LOPES ALVES DE MOURA ( Promotion: BCYB23 )

Company: CTIE

560, rue de Neudorf, L-2220 Luxembourg

Contact: Thomas TRAN
Email: thomas.tran@ctie.etat.lu
Phone: 247-71229

Description:
Le projet porte sur l'analyse des informations de log que nos systèmes produisent. Il s'agit de
- mettre en évidence les informations utiles.
- de donner la possibilité d'analyser ces informations dans les outils actuels ou, si nécessaire, de les transmettre à un outil séparé.

Tools:
- Analyse Log system Linux
- Log Auditd
- Log dans notre solution
- Log du type Firewall
- Mise en place d'un export vers une solution "Wazuh"

Period: 1743984000 – 1750982400

Tutor: Sam BERCK

Installation and configuration of a traffic analyser to detect DDoS attacks

Denim LATIC ( Promotion: BCYB21 )

Company: Restena

2, place de l’Université, L-4365 Esch-sur-Alzette

Contact: Jo HOFFMANN
Email: jo.hoffmann@restena.lu
Phone: 42 44 091

Description:
Some network anomalies can only be detected by analysing the traffic passing through it.
Technologies like netflow and IPFIX sample traffic passing through network equipment in real time and send aggregate statistics to a central node. Besides storing the data, the central node also evaluates the data along different kinds of parameters and metrics.
A project within GEANT has developed such an evaluation tool (NeMo) with a focus on detecting DDoS attacks.
The aim of this project is to evaluates NeMo with regards to anomaly and DDoS attack detection. While the first stages of the project will be concerned with implementation and configuration of the tool, subsequent stages will dive into the use-case of anomaly detection, and integration of the tool into the incident response ecosystem at Restena.

Tools:
• Installation of solution in Restena LAB environment
• Configuration and integration with netflow/sflow sources
• DDoS attack generation and detection
• General network flow analysis capabilities and anomaly detection
• Integration into Restena's incident handling process
• Time permitting evaluation of extensibility and integration with other tools such as OTRS, Firewall on Demand, ELK...

Period: 1680480000 – 1687478400

Tutor: Marc LUDWIG