Keeping computer networks safe from attack requires ever-increasing vigilance. Our work on applying locality to network intrusion detection is presented in this dissertation. Network servers that allow connections from both the internal network and the Internet are vulnerable to attack from all sides. Analysis of the behavior of incoming connections for properties of locality can be used to create a normal profile for such network servers. Intrusions can then be detected due to their abnormal behavior. Data was collected from a typical network server both under normal conditions and under specific attacks. Experiments show that connections to the server do in fact exhibit locality, and attacks on the server can be detected through their violation of locality. Key to the detection of locality is a data structure called a working-set, which is a kind of cache of certain data related to network connections. Under real network conditions, we have demonstrated that the working-set behaves in a manner consistent with locality. Determining the reasons for this behavior is our next goal. A model that generates synthetic traffic based on actual network traffic allows us to study basic traffic characteristics. Simulation of working-set processing of the synthetic traffic shows that it behaves much like actual traffic. Attacks inserted into a replay of the synthetic traffic produce working-set responses similar to those produced in actual traffic. In the future, our model can be used to further the development of intrusion detection strategies.

This project is about how free, open-source tools can create reasonable, secure and flexible remote access solutions for smaller companies with a limited budget.  Secure remote access to a working environment is a solution for its time, as last year Covid-19 change the working environment for millions of employers and employees. The importance of secure remote access to a working environment became noticeable as offices closed down and employers started working from home. Still, the need for secure access to the company's infrastructure remains. This is where Virtual Private Networks (VPNs) enter the picture, as it has a broad application scope and is particularly useful for secure remote access. My project was subdivided into three parts: How to implement secure remote access to a working environment within the requirements of the chosen company, which are an inexpensive solution with high-security features.  Automate the creation and distribution of all the necessary parts that their employees will need in a VPN structure. Research about the future direction regarding VPN and the importance of cybersecurity to help ensure security preparedness for the company. The chosen solution was OpenVPN and Google authenticator, together with a written bash script. It became a solution that was free, flexible, secure and scalable. But why the need and what about the future?  Research shows that a high percentage of small and medium-sized enterprises are vulnerable to cyberattacks. It also shows that these companies have the lowest cybersecurity. "It wouldn't happen to us" is dangerous but, sadly, a typical mindset throughout the S&M companies. It's primarily because of this S&M's are more exposed than larger companies. The future of VPN's has become more important than ever before, and it's something that during Covid-19 has risen in use all over the world, the research and development of VPNs has accelerated. The research objectives of this project are of high interest to many other organizations in the same position, and the presented work has helped answer the question: "Where will we stand in a few years regarding secure remote work, cybersecurity andencrypted networks?"