Computer Network Anomaly Detection in University Environment - Švarc, Lukáš (2023)
After several successful cyber-attacks on public sector institutions recently, it became clear that it was necessary to increase the level of protection for computer networks in university environment as well. While there are a number of commercial solutions based on firewall, antivirus or IPS technologies for the detection of known attacks, the capabilities of these tools are very limited for the detection of unknown attacks. Anomaly detection methods based on machine learning are essentially the only option for protection against these unknown attacks. The main objective of this thesis is to adapt selected anomaly detection methods using supervised machine learning techniques in order to enhance the security of information systems in the university environment. The specifics of the university environment and its differences from a typical business environment are supported by discussions with IT experts from Prague University of Economics and Business, University of Granada, and Athens University of Economics and Business, as well as by a questionnaire focused on working with the information system completed by more than two thousand employees and students at the Prague University of Economics and Business. Following the signing of the NDA, logs from the information system's traffic were collected for the period 2016–2020. This data was anonymized, and the captured attacks contained helped define the three most typical types of attacks in the university environment: Simple Automated Attack, Advanced Automated Attack, and Cyber Attack. Subsequently, a synthetic dataset generator for the university environment was created. This generator creates information system logs and inserts a parameterized number of attacks of a selected type, which could serve as an interesting tool for other researchers of the university environment worldwide.