This provides a direct way of handling captured network traffic from sources other than P2NMAP-Capture.py developed in Chapter 3. I tackled extracting key data from pcap files to convert them into the. In the near future, we plan to create a public detection set that will challenge the development of detection algorithms in order to detect unknown attacks.Ĭhet Hosmer, in Python Passive Network Mapping, 2015 Review The efficiency of the current detection method was tested only on a small number of attacks. We plan to perform more experiments with actual metric sets. Our future work focuses on extending the metrics set to achieve better results in the detection of buffer overflow attacks. The reason for the high classification capability of fewer metrics is that classification of buffer overflow attacks was highly predictable due to the size of data in fragmented packets, which caused the overflow, and the nature of valid communication with a small number of fragmented packets. For example, valid communication (according to the separation into valid and attack connections) represents a large majority of the samples in the testing dataset (approximately 99.24%). The training and testing samples may be biased towards a certain class of traffic.

In the experiments described we achieved 99.9 percent accuracy of detecting buffer overflow attacks by combining an existing proposed metrics set with our solution.Īccuracy is highly dependent on training samples parsed from captured network traffic. In this chapter, we focus on defining the process of extraction metrics from separated connections of captured network traffic and consequently focus attention on the experiments that proved the concept of a designed metrics set. Petr Hanacek, in Emerging Trends in ICT Security, 2014 Conclusion

Using wireshark as a forensic tool