Proposta de implementação do protocolo netflow como mecanismo proactivo de detecção de botnets baseada na análise de tráfego de rede em uma infraestrutura de sistema de informação: Instituto Nacional de Governo Electrónico (INAGE, IP/MoRENet)

Abstract

Cyberspace is an environment of interaction between various computer network infrastructures, where cyber threats are verified and pose security challenges. Botnets are among the main threats in cyberspace, standing out for their ability to carry out large scale attacks and infiltrate network infrastructures undetected, compromising critical systems. The main objective of this study was to propose the implementation of the NetFlow protocol as a proactive solution for detecting Botnets based on analysing network traffic, with a focus on the information systems infrastructure of MoRENet (Mozambique Higher Education and Research Institutions Network). However, to achieve the objectives of the study, mixed research was carried out, i.e. qualitative and quantitative, and data collection used documentary and bibliographical research, as well as interviews and questionnaires directed at the technical team of MoRENet's CSIRT (Computer Security Incident Response Team). Meanwhile, the study revealed that the implementation of the NetFlow protocol is a proactive solution for detecting Botnets in MoRENet's infrastructure, and stands out for its ability to analyse traffic in detail in real time, low cost, scalability and integration with existing security tools. The solution proved capable of identifying anomalous patterns associated with Botnet command and control (C&C) servers, reducing dependence on manual intervention and enabling rapid responses to incidents, with minimal impact on network performance. In addition, the solution not only mitigates threats associated with Botnets, but also offers a view of the activities taking place on the MoRENet network, which strengthens the ability to monitor and respond to emerging incidents. In view of the above, it is recommended that the proposed solution be continuously improved, from updating the infrastructure, performance testing and training professionals to deal with new cyber security threats and technologies. As well as the development of local studies on cyber incidents to support future research and practices for detecting Botnets.