Many devices currently connect to the internet. Some are pretty well secured, while others lack security due to bugs or other vulnerabilities. A scanner searches for available services on the internet or computer host using standard network protocols. An adversary uses a scanner to search for leaks in security. However, scanners encode their network traffic with a specific XOR pattern, also called a fingerprint of the scanner. However, finding those patterns is very computation-intensive on classical hardware. This thesis aims to use a special FPGA, namely a DFE, to find the fingerprints at a higher speed of 10 GBits/s. Additionally, it aims to find the limits of this DFE in terms of computation power and speed. We created a performance model to find the design requirements and used this data to choose the most optimal algorithm to find the fingerprints. The performance model showed that we would not reach the intended 10 GBits/s speed. Therefore, we chose the solution that would bring us as close as possible. The potential bandwidth we could reach is 2.4 GBits/s, approximately 12.7 times faster than an optimal high-end CPU implementation using a Ryzen Threadripper 3990x CPU.

The internet consists of many networks connected by the BGP protocol and can easily be manipulated by a hacker. Every day, hackers reroute internet traffic and use that to impersonate entities such as companies, devices and humans. To detect this rerouting, which is also know as a route leak, a BGP monitor can be used. A BGP monitor checks whether the local route is correct by comparing the local route to the route from hundreds of devices. The lower the percentage of the routes that are the same, the bigger the chance there is a route leak. Hence, a user can tell whether a hacker manipulated the route. This project aims to build a BGP monitor application, that will ease the process of finding whether a hacker rerouted a part of the internet. To achieve this, the Internet Monitor application has been developed. In the Internet Monitor, an admin can add different types of tasks that will be run by the devices. This input will then be transmitted to the backend and to the database, where they will be stored. After some time, the backend will send out the tasks to the nodes. The nodes will execute the task and send back the results to the backend. These results can then be used to check whether the information from BGP servers or the local result is the same, and thus not manipulated. Apart from this, Internet Monitor also offers the possibility to see the map of all the real-time traffic between devices.