Passive Traffic Analysis
A list of open ports is not enough. My Rust tool finds known vulnerabilities for them and links them to what is actually happening on the network.
- Rust
- TypeScript
- Nmap · Zeek · Suricata
- PostgreSQL
- CI / testy
- UX / UI
My bachelor’s thesis at FIM UHK is about service fingerprinting and passive network traffic analysis. The Rust tool first finds out which services run on the network and maps them to CPE identifiers and public CVE and CVSS vulnerability data.
It then imports Suricata events and Zeek logs, ties them to specific hosts and services and ranks the findings by priority. The output is a report with a validation trail that can be checked later. A web interface built with Axum and TypeScript shows the results on a network map, and I verified the released version from the package downloaded from GitHub.
Get in touch- Type
- Bachelor’s thesis · security
- Year
- 2026
- Visit
- GitHub ↗
In numbers
- 27,000 lines of Rust
- 60 tests
- defended 2026
What is inside
Nothing gets past
Across 242 test scenarios the tool caught everything it should, at 0.988 precision.
What to fix first
It joins the network inventory, vulnerability data (CVE, EPSS, KEV) and Zeek and Suricata traffic into a fix-first ranking.
Audit evidence
Every report carries a SHA-256 manifest, so it can later be shown to be untouched.
Data stays on-site
Detection is deterministic. An optional local model only explains the findings and sends nothing out.
Got a similar project? Tell me what you need.kontakt@jirkapelikan.cz
Get in touch