Network Analysis & Java IDS development

computing case study with two tasks. Task 1 is analyse a pcap file and identify what causing the incident. Task 2 is develop an IDS with the use of the material provided. The ids must detect as many attacks as possible and you must report them in a human readable format.

Part1 Task 1 25% What you must do The initial report from the IT department

was that many machines were reported to slow down and most of the communications in the network were degraded.

Analsyse the pcap file that has been made available to provide probable cause of the symptoms may be (within your expertise ) and make recommendations to prevent this from reoccuring.

Part 2 Task 2 75% What you must do

You are hired to create such an IDS, using two datasets that are provided to you from the company IT department. These datasets are from a different subnetwork of the company and contain different IP addresses from the Pcap file. The first dataset contains normal traffic and the second contains different kinds of attacks. Your IDS must be able to detect as many attacks as possible and report them in a human readable form.

You are advised to use javaml-0.1.7 library steps:

1. Analyse the malicious traffic data in order to understand the different attacks that exist (Have in mind that you have been provided with CSV data that contain only basic features of the packets).

2. Pre-process the data and extract the useful features.

3. The malicious dataset does not contain labels on data. Use a OCSVM classification technique as it does not need labelled data .

4. Implement the appropriate classification method.

5. Train the method using the normal or the malicious depending on the methods you have chosen.

6. Create a reporting class that can create proper outcomes (e.g. XML, txt or IDMEF files) Deliverables

Task 1.

At the end of this investigation you must have a short incident report of you findings. Task 2.

Here you must effectively submit a runnable IDS and a technical report. Describing the method, the data and the outcomes.

Extra notes  I have already chosen a method tha I wish to use.

 OCSVM- as the dataset is not labeled

 The data needs to be transformed into a ocsvm ready format before processing.

 Significant features that are required for analysis must be set. In options.

 Information regard

The specification ha been given and can be uploaded upon request. The OCSVM classification has been provided simply edit it the parameters such as path of training dataset. The features that it should effectively use for training and the xml result it should return.