Term paper on Network Forensics/Intrusion Detection.

Hello everyone,

I'm currently working on a term paper on Network Forensics and Intrusion Detection. I was wondering if anyone had any information I could use, and if I could schedule an Interview with some of you who have a good background on these matters. I'm planning on using Hacker's Challenge 4th edition, Hacking Exposed fourth edition, and many other websites as references. I was thinking of taking a scenario of an attack, and after mentioning the approach written on the book, I would explain my own approach and possibly the tools that I would use. I'm open for any ideas and any help would be greatly appreciated.

Thank you so much :D

Intrusion Detection: An Analyst Guide by Stephen Northcutt should be a must in your studies in regards to this. You might want to look at some of the "I got 0wned" threads by some of the members here as they might be able to give you some insight into what happens. Also Issue #9 has a nice "I got rewted" article. :)

Thank you very much mittens :). I was actually telling my professor about you, and the wargame classes that you had :)...he thought it was an excellent Idea. I'll def. look into those.

Recently I've also been testing out LC4 and Cain & Abel password auditing tools and their risk to a network. Perhaps i'll mention those on the paper. I'll post the final paper when i'm done :.

Hehe. Might want to look into the dangers of Ettercap and the Offline NT Password and Registry Editor Bootdisk. Heck, phishing, IMHO, is the new method of choice along with browser hijacking for intrusions and attacks.

I'm glad your prof liked it. :) Is he going to use it for a class?

The current lab that we're in could be turned into one, but he's going on vacation for 6 weeks in march :(. I don't know about the new proffesor but I'll soon be in charge of a couple of servers at the school, maintaining them. I could work on creating a wargame environment but It has to go through the proper authorities :). If i was the one to set it up it would turn more into a script kiddie class rather than a learning environtment unless the teacher is the one supervising the whole thing.

Here are a couple of sites to look at,maybe give you some ideas.

http://www.nw3c.org/

National White collar crimecenter. They do Forensics and teach classes on it.

http://www.counterhack.net/

Ed Skoudis has several "Hacker challenges" posted here. He is the Track IV guy for SANS. Read through them and the solutions posted, could give you topics for your paper and /or scenarios for your wargaming. They are educational and a little entertaining since he likes to base each one off of a pop culture idiom. Since the solutions are also posted you get a good idea of what is going on, and each one covers a specific vulnerability.

Don't forget the regular end user that downloads wack-a-mole on his network workstation! Skiddies aren't glamorus, but are still a threat as long as the end user remains ignorant of the risks.

Also, If you're looking for case studies, there's plenty in the SANS website, as well as some research papers written on this subject that you could download. Some of them are good, others are not so good. Read through them and you'll have a good idea of what others have covered in their term/research papers, so you can pick a more original approach, or use some of their data (no plagerism :) ).

as far as the interview thing goes, I'm open, as are a few of my associates (I have one that is the head of information security for an international shipping provider that gets attacked several hundred times per hour, drawback of being a global operation)

Thank you 57...... (god lol...couldnt u get an easier name :D). I'll talk to my professor in a few minutes and see what I can do. I love your sig by the way...and the link is nuts :) Gotta put that on my AIM profile to keep my GF's ex away from it lol.

I know of a friend of mine who had developed IPS with honeynet capability using snort inline and iptables......

It was able to work at application level.... whereby he could actually retrict access of a user to a website based on his/her user ID......

Just such for shomiron dasgupta on google.. I guess he has the project on opensourceforge.....

I am not sure how much would that help u.... In case u feel it can I shall arrange for u to speak to him aswell......

OK i've started writting the paper. Actually this is a smaller version, only 6-8 pages and its for my english class. The CNIS term paper is due march 30th so I still have some time to work on that.

This is my introduction:

Introduction:

Network and computer forensics are investigative analyses of network and computer logs, files, file systems, and hard drives to obtain evidence of cyber-attacks, computer break-ins and other electronic crimes. There is a wide array of tools used for analyses, which vary from one job to the other. I will not get into great detail about the tools since there’s so many and their terminology is quite advanced, making them incomprehensive to the basic computer user. I will only mention a few, which I’ve used throughout the time I’ve spent studying Network Forensics. These tools help system administrators turn into cyber-detectives trying to keep users safe from harm.



Please throw any ideas you might have...i'm kinda stuck. I dont want to talk too much about the tools but instead get more into the discussion of Network Forensics. I'll also be talking about the Stop, look and listen" systems and · "Catch-it-as-you-can" systems. Throwing a few sentences I could use would be very helpful, and i'll ellaborate from them. Thank you for your help guys/gals... i really appreciate it :)

I would maybe start talking about why network forensics has become such a popular area to IT professionals.

What kind of knowledge must you have to be a good network forensics person?

First, its analysis not analyses

Second, talk about why you need to do this, what purpose does forensics serve? quote legal requirements, patching holes so you aren`t attacked again etc.. Also who is actually doing this work? (as far as I am aware there are only a small number of professionals who just do forensic work, many times it will be security pros in general).

Next, talk generically about some of the tools and techniques used, don`t go into specific tools, but instead talk about data recovery tools, log analysis, etc...

Then walk through a real life example showing how the various tools and techniques that you previously mentioned are used this way you show them in a practical context. Now my advice would not be to spend pages going through TCP dump output, as this will get a little dull..

Towards the end why not address future advances in the technology, speak about how as attacks get more sophisticated that more sophisticated tools may be required


hope this helps.

lol Ronin...i thought i was making analysis plural that way :)...thnx

It helps me a whole bunch. Thank you guys.

I like your sig btw ;) ...but really, Who is guarding the guards?

or watching the watchmen?

and that would be telling.

Cybr1d, we have some forensic folk at work, I`ll see if I can dig anything up of use for you.


and lol, I thought i could spell.....

lol, whitehat your missing a 4 :P

Umm...the intro sounds a little bit too...choppy... 'Computer forensics are, etc etc etc.', that doesn't flow...

Try something like "The world of computerized networking has grown at a vast rate in the last 50 years since it was first implimented. Now, the internet is almost of a new world, and in this world, there is good and bad. The good outweighs the bad some people say..but still, as any community grows there is a need for control and policing. If there wasn't then the community would be in an uproar. One of the tools used by this Police force, is network and computer forensics. Not only is this a safe way to keep the criminals at bay, it's the most effective science for investigation we've come across since the old days of ARPAnet. To combat the wrong doings of the internet, computer forensics has many flavors, but most of all, network and computer forensics is the science of monitoring several computer logs, bundles of software and hardware, and overall communication between every circuit in a computerized environment to determine what, exactly, went wrong. Computer forensics is not only an asset to this community, but it's much needed. Today, it's used to not only prevent future occurences of a crime taking place, but monitor the events of the computer underworld, to know exactly what happened, and when it did, so we can patch ourselves from another occurence. First off i'll go in depth with how computer forensics works.."....etc etc etc.

You sound too choppy in your words..just something i've noticed..dunno if thats what u were goin for but ya..people like flow more then choppy facts as i've seen. Just my 2c.