Det finns idag fortfarande komponenter i det globala mobilnätet som använder teknologi som utvecklades på 70-talet. Nyare, säkrare system har införts i flera länder, men även dessa behåller sin förmåga att kommunicera med de mer sårbara äldre systemen och delar därmed deras säkerhetsproblem. Det är speciellt protokollstacken SS7, grunden till 2G som har stora säkerhetsbrister. Syftet med denna uppsats är primärt att designa samt implementera en Elastic Stack pipeline och avgöra vad för information som kan erhållas vid användandet av denna pipeline på SS7-signaleringstrafik från ett faktiskt mobilnätssystem. Ur detta formulerades även ett antal delsyften. En pipeline implementerades och testades ihop med flera olika format på inläst data. Det gjordes fyra experiment där olika funktionaliteter testades med hjälp av utvalda dataset vars syfte var att agera substitut till den sekretessbelagda faktiska mobilnätsdatan. Elastic Stack är enligt vår uppfattning ett lovande verktyg för att övervaka och analysera SS7-signaleringstrafik, men det finns ett antal hinder som bara delvis beror på att mjukvaran är under utveckling. Dessa går dock till större del att kringgå. / There are currently components of the global mobile network that use technology developed in the 1970s. Newer, more secure systems have been introduced in several countries, but even these retain their ability to communicate with the more vulnerable older systems, and thus share their security issues. The purpose of this thesis is primarily to design and implement an Elastic Stack pipeline and determine what information can be attained through the use of this pipeline on SS7 signalling traffic from an actual mobile network system. To accomplish this, a series of sub-purposes also emerged. A pipeline was implemented and tested with several different formats of data. A series of four experiments were performed where different functionalities were tested with the help of selected data sets whose purpose was to act as substitutes for the classified actual mobile network data. Elastic Stack is, in our opinion, a promising tool for monitoring and analyzing SS7 signalling traffic, but there are a number of issues that can only partially be attributed to the software being still in development. They are however largely circumventable.

I dagsläget finns det en mängd utmaningar och svårigheter inom den traditio- nella designprocessen för användarupplevelse (UX, User Experience). Dessa utmaningar har en påverkan på hur tidskrävande och kostsam en designpro- cess för UX kan vara. Några av dem är att få prototyper att likna slutpro- dukten och kommunikationssvårigheter mellan UX-designers och utvecklare vid Agil projektmetodik. Några svårigheter som finns vid visualisering av strömmande data är att göra den lättförståelig för användaren och möjliggöra användaren att nå önskad information. För att undersöka dessa svårigheter togs en designprocess för UX, att använ- das med datavisualiseringsverktyget Kibana, fram. För att kunna utvärdera och bedöma designprocessen för UX, skapades en interaktiv dashboard som presenterade Transportstyrelsens data från betalstationer. Framtagningen av designprocessen för UX resulterade i en optimering av prototypskapandet och testningen. Detta eftersom designprocessen för UX möjliggjorde utveckling av produkten, istället för prototypen, vilket förbättrade testningen med slutan- vändaren och därmed även slutprodukten. Det fanns dock nackdelar då Kiba- na användes vilka var begränsningar i modifieringen av användargränssnittet och att systemet behövde vara klart innan designprocessen för UX kunde på- börjas. / In the current situation there are a lot of challenges and difficulties in the traditional design process for UX, User Experience. These challenges have an impact on how time consuming and costly a design process for UX can be. Some of them are to create prototypes that resemble the end product and communication difficulties between UX-designers and developers that follow an Agile project methodology. There are also difficulties in visualizing streaming data, as information in data must be made easy to understand for the user and the users must be able to get desired information. To investigate these difficulties, a design process for UX was created to be used with the Kibana data visualization tool. In order to evaluate and assess the design process for UX, an interactive dashboard was created that pre- sented data from Swedish payment stations. The development of the design process for UX resulted in an optimization of the prototype-creation and test- ing. The design process for UX enabled development of the product, instead of the prototype, which improved the testing with the end user and therefor also the end product. However, there were disadvantages when Kibana was used which were limitations in modifying the user interface and that the sys- tem needed to be ready before the UX design process could begin.

The purpose of this thesis is to investigate and implement a framework for log management and analysis tailored to the treatment planning system (TPS) RayStation. A TPS is a highly advanced software package used in radiation oncology clinics, and the complexity of the software makes writing robust code challenging. Although the product is tested rigorously during development, bugs are present in released software. The purpose of the the framework is to allow the RayStation development team insight into errors encountered in clinics by centralizing log file data recorded at clinics around the world. A framework based on the Elastic stack, a suite of open-source products, is proposed, addressing a set of known issues described as the access problem, the processing problem, and the analysis problem. Firstly, log files are stored locally on each machine running RayStation, some of which may not be connected to the Internet. Gaining access to the data is further complicated by legal frameworks such as HIPAA and GDPR that put constraints on how clinic data can be handled. The framework allows for access to the files while respecting these constraints. Secondly, log files are written in several different formats. The framework is flexible enough to process files of multiple different formats and consistently extracts relevant information. Thirdly, the framework offers comprehensive tools for analyzing the collected data. Deployed in-house on a set of 38 machines used by the RayStation development team, the framework was demonstrated to offer solutions to each of the listed problems.

There is a growing need for more efficient tools and services for log analysis. A need that comes from the ever-growing use of digital services and applications, each one generating thousands of lines of log event message for the sake of auditing and troubleshooting. This thesis was initiated on behalf of one of the departments of the IT consulting company TietoEvry in Karlstad. The purpose of this thesis project was to investigate whether the log analysis service Elastic Stack would be a suitable solution for TietoEvry’s need for a more efficient method of log event analysis. As part of this investigation, a small-scale deployment of Elastic Stack was created, used as proof of concept. The investigation showed that Elastic Stack would be a suitable tool for the monitoring and analysis needs of TietoEvry. The final version of deployment was, however, not able to fulfill all of the requirements that were initially set out by TietoEvry, however, this was mainly due to a lack of time and rather than limitations of Elastic Stack.

As infrastructures and software grow in complexity the need to keep track of things becomes important. It is the job of log aggregation solutions to condense log data into a form that is easier to search, visualize, and analyze. There are many log aggregation solutions out there today with various pros and cons to fit the various types of data and architectures. This makes the choice of selecting a log aggregation solution an important one. This thesis analyzes two full-stack log aggregation solutions, Elastic stack and SigNoz, with the goal of evaluating how the ingestion and storage components of the two stacks perform with smaller and larger amounts of data. The evaluation of these solutions was done by ingesting log files of varying sizes into them while tracking their performance. These performance metrics were then analyzed to find similarities and differences. The thesis found that SigNoz featured a higher CPU usage on average, faster processing times, and lower memory usage. Elastic stack was found to do more processing and indexing on the data, requiring more memory and storage space to allow for more detailed searchability of the ingested data. This also meant that there was a larger storage space requirement for Elastic stack than SigNoz to store the ingested logs. The hope of this thesis is that these findings can be used to provide insight into the area and aid those choosing between the two solutions in making a more informed decision.