Network Analysis and Java IDS development

Computing case study with two tasks. Task 1 is analyse a pcap file and identify what causing the incident. Task 2 is develop an IDS with the use of the material provided. The ids must detect as many attacks as possible and you must report them in a human readable format.

Part1

Task 1

The initial report from the IT department was that many machines were reported to slow down and most of the communications in the network were degraded.

What you must do

Analsyse the pcap file that has been made available to provide probable cause of the symptoms may be (within your expertise ) and make recommendations to prevent this from reoccuring.

Part 2

Task 2

You are hired to create such an IDS, using two datasets that are provided to you from the company IT department. These datasets are from a different subnetwork of the company and contain different IP addresses from the Pcap file. The first dataset contains normal traffic and the second contains different kinds of attacks. Your IDS must be able to detect as many attacks as possible and report them in a human readable form.

You are advised to use javaml-0.1.7 library steps:

1. Analyse the malicious traffic data in order to understand the different attacks that exist (Have in mind that you have been provided with CSV data that contain only basic features of the packets).

2. Pre-process the data and extract the useful features.

3. The malicious dataset does not contain labels on data. Use a OCSVMclassification technique as it does not need labelled data .

4. Implement the appropriate classification method.

5. Train the method using the normal or the malicious depending on the methods you have chosen.

6. Create a reporting class that can create proper outcomes (e.g. XML, txt or IDMEF files)

Extra notes
• OCSVM- as the dataset is not labeled
• The data needs to be transformed into a ocsvm ready format before processing.
• Significant features that are required for analysis must be set. In options.
• Information regard

The specification ha been given and can be uploaded upon request.

The OCSVM classification has been provided simply edit it the parameters such as path of training dataset. The features that it should effectively use for training and the xml result it should return.