Ing. Matej Hulák

Ing. Matej Hulák

Ing. Mgr. Ladislava Smítková Janků, Ph.D.

Department of Applied Mathematics

Knowledge of the internal structure of customer networks is crucial for Internet Service Providers (ISPs) in terms of planning, security, and traffic management. However, traditional tools often do not provide sufficient insight into the internal structure of the network, especially in environments utilizing Network Address Translation (NAT). This thesis focuses on the analysis of methods for detecting devices operating NAT using network flow analysis and the subsequent implementation of a functional module for the NEMEA system utilizing selected machine learning methods. In the theoretical part, the thesis addresses the analysis of network traffic monitoring, the principles of NAT operation, and an overview of existing NAT detection methods. The practical part describes the processing of a publicly available dataset of network traffic, the design of a methodology for its aggregation into a form suitable for machine learning, and the application of machine learning methods themselves. The result of this thesis is a functional extension module for the NEMEA system which, based on the conducted analysis and experiments, enables the detection of NAT occurrence and thus provides ISPs with a tool for analyzing the structure of network infrastructure.

Thesis on DSpace

Ing. Matej Hulák

Ing. Martin Šutovský

Department of Information Security

This bachelors thesis addresses the detection of Mirai botnet activity and rela ted variants using network flow data. The goal is to design an understandable and practically deployable approach that derives behavior-based features, uses the IoT-23 dataset for experimental evaluation, and leads to a model suitable for deployment in the NEMEA framework. The proposed method is based on characteristic manifestations of Mirai, especially network scanning, command and-control communication, and attack activity, which are captured by aggre gated features computed over short non-overlapping time windows. The final deployment-oriented variant uses an interpretable decision tree with a 5 s win dow and achieves very strong results on the IoT-23 test set while remaining easy to explain. The practical outcome of the thesis is a prototype Python mo dule for the NEMEA framework that continuously processes flow records and emits outputs for downstream detection components when suspicious behavior is observed.

Thesis on DSpace

Ing. Matej Hulák

Ing. Jaroslav Pešek

Department of Information Security

This thesis focuses on device classification in computer networks based on flow-level data. The objective is to design and experimentally evaluate a me- thod capable of distinguishing device types using only aggregated statistical characteristics of network traffic. Flow data were collected from a real network environment and processed using time-based aggregation into fixed-length windows. A classification model based on the Random Forest algorithm was trained on aggregated features. The model was evaluated using accuracy, precision, recall, and F1-score metrics, with special attention paid to class imbalance. Experimental results demonstrate that the proposed approach enables re- liable differentiation between device types and confirm the suitability of flow- based analysis in environments dominated by encrypted traffic.

Thesis on DSpace

Ing. Matej Hulák

Ing. Josef Koumar

Department of Information Security

The thesis aims to detect proxy servers, specifically the Residential Proxy servers (RESIP) in the network based on the analysis of network flows from the perspective of an Internet Service Provider (ISP). By applying machine learning techniques a functional module for the NEMEA system will be developed. This module detects RESIP in the network thereby enhancing network management and security.

Thesis on DSpace

Ing. Matej Hulák

Mgr. Martin Jureček, Ph.D.

Department of Information Security

This bachelors thesis focuses on the classification of operating systems based on network flows. Machine learning methods are used for the classification. Before applying machine learning, relevant information is aggregated from the network flows to serve as input features. The solution is implemented in the Python programming language using the scikit-learn library and also includes analysis of the machine learning model's outputs. The best result was achieved using the Random Forest algorithm, which reached an 86,46 % F1-macro score on the test dataset. Real-world testing on production network data showed that even without some input features, the module is capable of classifying devices with an F1-macro score of 59,08 %. The results indicate potential for further improvement in classification accuracy and reliability. To enable the application of the classifier a module for the NEMEA system is developed, capable of performing the classification in real time.

Thesis on DSpace