Ferramenta para centralização e análise de logs de cibersegurança de instituição de ensino superior

Abstract

In many educational institutions, computer laboratories are essential spaces for providing technological resources to students, enabling research activities, project development, programming practice, and the use of specific software related to their fields of study. However, the management and security of these laboratories can face significant challenges, particularly regarding the monitoring of machine usage, including website access, installation of unauthorized software, detection of technical failures, and protection against security threats such as malware and unauthorized access. Users with access to the laboratory or the institution’s network may engage in inappropriate activities, such as sending malicious emails, accessing improper websites or content, among other actions that compromise security and the responsible use of technological resources. In this context, the aim of this study is to develop a solution for the retrieval and analysis of logs, which are automatic records generated by systems that store information about accesses, errors, and various events, in order to facilitate the identification and tracking of improper activities. Additionally, the study aims to rebuild the legacy system previously used in the DACOM, employing modern technologies to improve its performance, usability, and maintainability. The methodology adopted in this work consists of centralizing the logs from the computer laboratories on a server through rsyslog. This solution was integrated into the laboratory monitoring system, which was restructured within the scope of this project, enabling the visualization and analysis of the collected data and facilitating the identification of incidents and the monitoring of machine operation. The solution was evaluated through a case study conducted at the UTFPR Campo Mourão campus, with the objective of validating its efficiency in identifying improper activities and improving the security and management of the laboratories. The implementation of this solution demonstrated practical viability and potential for replication in other educational institutions, contributing to more efficient management of technological resources.