The main goal of the master thesis is to introduce an architecture for Distributed Complex Event Processing for network security monitoring to address real time monitoring of IP flow records to be able to detect DDOS attacks. The solution will leverage Complex Event Processing within a IP flow monitoring approach.

Distributed nature means that event stream is being processed by multiple computers (nodes). Student will use open-source engine Esper for Complex Event Processing.

First part of the master thesis will consist of the design and implementation of a module to provide distributed architecture. Student will choose proper technologies to provide this functionality. This module will be independent which means that it is possible to integrate it with any data stream (not only with IP flow data).

In second part of the master thesis student will use this module to build architecture for detection of DDOS flooding attacks (SYN flood). Student will implement algorithm for detection of these types of attacks which will be leveraged within this architecture. Student will perform experiment using IP flow dataset to show that his designed distributed architecture is able to detect DDOS flooding attacks.