NetFlow-based NAT detection module

• Authors: KRMÍČEK Vojtěch; VYKOPAL Jan; PLESNÍK Tomáš; RUŽIČKA Andrej; ČELEDA Pavel; TRUNEČKA Michal
• Year of publication: 2009
• MU Faculty or unit: Institute of Computer Science
• Description: Netflow-based NAT detection module consists of five detection methods that process extended NetFlow data (IPid, TTL, PortSequences, SubnetTTL and TCP_SYN) and aggregator. Each of detection method produces a list of IP addresses and uncertainty of NAT behind the given IP address. The aggregator evalutes and correlates these outputs and produces total uncertainty of NAT behind the given IP addres.

Related projects

• CYBER - Security of Czech Army Information and Communication Systems - On-line Monitoring, Visualization and Packet Filtration. Computer Incident Response Capability Development in the Cyber Defence Environment