INTEGRATION OF BRO(ZEEK) TOOL FOR ATTACK DETECTION AND ELK STACK FOR ANALYSIS AND VISUALIZATION

Potreba za visokom razinom mrežne sigurnosti danas je vrlo velika, te neprestano raste, kako za zaštitu pojedinih računala tako i za zaštitu cjelokupne mreže. Sustav koji automatizirano prati mrežne i sistemske događaje u svrhu otkrivanja kršenja sigurnosne politike naziva se sustav za otkrivanje napada. Ovaj rad se bavi takvim sustavima. Temeljem toga objašnjene su mogućnosti i metodologije sustava za otkrivanje napada. U praktičnom dijelu rada prikazane su mogućnosti Bro (Zeek) alata otvorenog koda koji služi za otkrivanje napada na sustav i nadgledanje mrežnog prometa u stvarnom vremenu. Kako takvi alati generiraju jako puno log zapisa (engl. log files), u praktičnom dijelu rada predložena je integracija Bro (Zeek) alata s ELK Stack-om koji omogućava centralizirano skupljanje svih Bro (Zeek) logova, njihovu analizu i te vizualizaciju. Rezultat svega toga je sustav koji omogućava korisniku dosta iscrpnu i detaljnu analizu, i grafičku vizualizaciju mrežnog prometa.The need for a high level network security today is very high, and is constantly growing, both to protect individual computers and to protect the entire network. A system that automatically monitors network and system events for the purpose of detecting security policy violations is called an intrusion detection system. This paper deals with such systems. Based on this, the possibilities and methodologies of the attack detection system are explained. The practical part of the paper presents the possibilities of the Bro (Zeek) open source tool that is used to detect intrusions into the system and monitor network traffic in real time. As such tools generate a lot of log files, the practical part of the paper proposes the integration of Bro (Zeek) tools with ELK Stack, which enables centralized collection of all Bro (Zeek) logs, their analysis and visualization. The result of all this is a system that allows the user a very comprehensive and detailed analysis and graphical visualization of network traffic