Tasks Part 1 - Packet Captures In this assessment you are required to select a network...

Transcribed Image Text:

Tasks Part 1 - Packet Captures In this assessment you are required to select a network protocol, and design and conduct experiments to demonstrate: i. The behaviour of the protocol during normal conditions, i.e., the network is not under attack; and The behaviour of the protocol that is symptomatic of unusual conditions, i.e., the network is currently being attacked. For the purpose of this demonstration you may select any network protocol, whether examined in the unit or not. Make sure that you understand normal and abnormal behaviour of the protocol, however. For example, malware being downloaded over HTTP is not in itself unusual behaviour - HTTP will malicious and non-malicious files without any change in behaviour. The behaviour of your chosen protocol, both during normal conditions and during attack, must be captured and saved in Wireshark PCAP/PCAPNG files (select File Save As in Wireshark). You can submit your captures either in a single PCAP file or multiple PCAP files, however you must clearly identify which files/packet numbers are relevant in your report. You are responsible for ensuring that any traffic you generate is appropriately isolated and does not impact real networks, as noted in the warning on the front page of this task. Before selecting a protocol and attack for the purposes of this task, you should first review the requirements of the report below and the rubric to ensure you select an appropriate protocol for the grade that you are targeting. In particular, the highest grading for several rubric criteria require that you demonstrate an attack that is not covered by the unit, i.e., the unit materials do not include step-by-step instructions for performing the attack you have selected. Part 2 - Written Report Prepare a written report on the protocol and behaviour you have demonstrated addressing the following points (you must use the headings indicated): 1. Introduction ( <0.5 page): . 3. Briefly discuss why understanding the difference between normal and abnormal behaviour of network protocols is an important skill for cybersecurity practitioners. Introduce the protocol you will be demonstrating and what it is used for in computer networks. 2. Normal Behaviour ( <1 page): Introduce the attack you will be demonstrating and the potential damage the attack could cause to a vulnerable network. . Provide step-by-step instructions for your experiment to generate the normal behaviour of your selected protocol. These instructions must be clear enough for someone to repeat the experiment without requiring further research. Example aspects you should cover include explaining any platforms, software, and techniques used, any configuration steps required, and the commands/GUI steps necessary to actually run the experiment (you may wish to use screenshots to clarify where necessary). Referring the network protocol traffic you captured during this experiment, explain the normal behaviour of the protocol that is relevant to the attack you will conduct in Part 3 i.e., for those aspects that will be affected by the security attack, include screenshots from your packet captures showing the relevant packets and the content of those packets (the middle panel in Wireshark) and refer to what is shown in these screenshots to explain the normal behaviour of the protocol. Abnormal Behaviour ( <1 page): . Provide step-by-step instructions for your experiment to generate the abnormal behaviour of your selected protocol (refer to Normal Behaviour for the expectations of this task). Explain how the security attack has modified the behaviour of the protocol and why this behaviour should be considered abnormal. Refer to the network protocol traffic you captured as you did for normal behaviour (i.e., screenshots and explanations). Citations and Referencing When completing any work it is necessary to acknowledge the work of others that you have relied upon. For written assessment, we achieve this through the use of citations and references. Failing to correctly identify the work of others is known as plagiarism and is considered an issue of Academic Integrity. If your submission to this task has involved the work of others, you must include citations and references where appropriate. Deakin provides a web site that explains how to use citations and references, and includes explanations of various referencing styles: https://www.deakin.edu.au/students/studying/study-support/referencing You may select any style for your citations/references, however you must be consistent in applying that style in this task (you can use other styles in other tasks if you wish). Relevance depends on the protocol and the attack selected. For example, if you were to examine TCP and a TCP SYN flood attack, you would only need to explain/illustrate TCP's connection establishment mechanism. www Tasks Part 1 - Packet Captures In this assessment you are required to select a network protocol, and design and conduct experiments to demonstrate: i. The behaviour of the protocol during normal conditions, i.e., the network is not under attack; and The behaviour of the protocol that is symptomatic of unusual conditions, i.e., the network is currently being attacked. For the purpose of this demonstration you may select any network protocol, whether examined in the unit or not. Make sure that you understand normal and abnormal behaviour of the protocol, however. For example, malware being downloaded over HTTP is not in itself unusual behaviour - HTTP will malicious and non-malicious files without any change in behaviour. The behaviour of your chosen protocol, both during normal conditions and during attack, must be captured and saved in Wireshark PCAP/PCAPNG files (select File Save As in Wireshark). You can submit your captures either in a single PCAP file or multiple PCAP files, however you must clearly identify which files/packet numbers are relevant in your report. You are responsible for ensuring that any traffic you generate is appropriately isolated and does not impact real networks, as noted in the warning on the front page of this task. Before selecting a protocol and attack for the purposes of this task, you should first review the requirements of the report below and the rubric to ensure you select an appropriate protocol for the grade that you are targeting. In particular, the highest grading for several rubric criteria require that you demonstrate an attack that is not covered by the unit, i.e., the unit materials do not include step-by-step instructions for performing the attack you have selected. Part 2 - Written Report Prepare a written report on the protocol and behaviour you have demonstrated addressing the following points (you must use the headings indicated): 1. Introduction ( <0.5 page): . 3. Briefly discuss why understanding the difference between normal and abnormal behaviour of network protocols is an important skill for cybersecurity practitioners. Introduce the protocol you will be demonstrating and what it is used for in computer networks. 2. Normal Behaviour ( <1 page): Introduce the attack you will be demonstrating and the potential damage the attack could cause to a vulnerable network. . Provide step-by-step instructions for your experiment to generate the normal behaviour of your selected protocol. These instructions must be clear enough for someone to repeat the experiment without requiring further research. Example aspects you should cover include explaining any platforms, software, and techniques used, any configuration steps required, and the commands/GUI steps necessary to actually run the experiment (you may wish to use screenshots to clarify where necessary). Referring the network protocol traffic you captured during this experiment, explain the normal behaviour of the protocol that is relevant to the attack you will conduct in Part 3 i.e., for those aspects that will be affected by the security attack, include screenshots from your packet captures showing the relevant packets and the content of those packets (the middle panel in Wireshark) and refer to what is shown in these screenshots to explain the normal behaviour of the protocol. Abnormal Behaviour ( <1 page): . Provide step-by-step instructions for your experiment to generate the abnormal behaviour of your selected protocol (refer to Normal Behaviour for the expectations of this task). Explain how the security attack has modified the behaviour of the protocol and why this behaviour should be considered abnormal. Refer to the network protocol traffic you captured as you did for normal behaviour (i.e., screenshots and explanations). Citations and Referencing When completing any work it is necessary to acknowledge the work of others that you have relied upon. For written assessment, we achieve this through the use of citations and references. Failing to correctly identify the work of others is known as plagiarism and is considered an issue of Academic Integrity. If your submission to this task has involved the work of others, you must include citations and references where appropriate. Deakin provides a web site that explains how to use citations and references, and includes explanations of various referencing styles: https://www.deakin.edu.au/students/studying/study-support/referencing You may select any style for your citations/references, however you must be consistent in applying that style in this task (you can use other styles in other tasks if you wish). Relevance depends on the protocol and the attack selected. For example, if you were to examine TCP and a TCP SYN flood attack, you would only need to explain/illustrate TCP's connection establishment mechanism. www