VISUALIZATION OF TRAFFIC MONITORING IN OPENFLOW NETWORK WITH ELK STACK

• Main Author: Athalah, Faza
• Format: Final Project
• Language: Indonesia
• Online Access: https://digilib.itb.ac.id/gdl/view/48209
• Institution: Institut Teknologi Bandung

The number of Internet users is rising over time. This becomes a challenge for networks to allow increased number of users while maintaining performance. Networks nowadays suffer from scalability issues due to the need of configuring every single device in the network, which consumes time and resources. The solution to this problem is Software-Defined Networking (SDN). SDN centralizes management of every device into one management point, which saves a lot of time. SDN is also programmable, meaning the administrator can install custom security protocols on the network. SDN does not have a simple and clear monitoring interface for administrators to notice what is happening in the network, which is a problem. This final project’s objective is to design a user-friendly monitoring visualization system that shows clear information on what is happening in the network and understandable to all kinds of users. This is done using Snort, Elasticsearch, Logstash, and Kibana. Snort will generate a file containing event logs of the network in JSON format. The file will then be transferred to Elasticsearch using Logstash. Kibana will then retrieve the data for visualization. The monitoring visualization will take form of a Dashboard. The Dashboard is designed specifically to show information realted to two kinds of network attacks, namely Trojan and DDoS attack. The Dashboard contains 10 charts, in which the data shown on the chart is in accordance to a specified time range. The Dashboard can only be accessed by a Network Administrator. Network Administrator can modify the Dashboard by either changing the time range, changing the contents of the Dashboard, and saving the static Dashboard in the form of embed, code, PDF, and PNG. After doing system testing by simulating Trojan and DDoS attack, the system successfully visualizes clear information that indicate network attacks in accordance to a specified time range.