American Military University Cybersecurity & Network Forensics Article Paper It a minimum of 600 words, summarize the article, Cybersecurity and Network Fo

American Military University Cybersecurity & Network Forensics Article Paper It a minimum of 600 words, summarize the article, Cybersecurity and Network Forensics: Analysis of Malicious Traffic towards a Honeynet with Deep Packet Inspection, as it pertains to computer forensics. Bibliography Rodrigues, G. A., Albuquerque, R. d., Deus, F. E., Jr, R. T., Júnior, G. A., Villalba, L. J., & Kim, T.-H. (2017). Cybersecurity and Network Forensics: Analysis of Malicious Traffic towards a Honeynet with Deep Packet Inspection. Applied Sciences, 7(10), 1082. doi:10.3390/app7101082 applied
sciences
Article
Cybersecurity and Network Forensics: Analysis of
Malicious Traffic towards a Honeynet with Deep
Packet Inspection
Gabriel Arquelau Pimenta Rodrigues 1,† , Robson de Oliveira Albuquerque 1,† ,
Flávio Elias Gomes de Deus 1,† , Rafael Timóteo de Sousa Jr. 1,† , Gildásio Antônio de Oliveira Júnior 1,† ,
Luis Javier García Villalba 2, *,† and Tai-Hoon Kim 3,†
1
2
3
*
†
Cybersecurity INCT Unit 6, Decision Technologies Laboratory-LATITUDE, Electrical Engineering
Department (ENE), Technology College, University of Brasilia (UnB), Brasília-DF 70910-900, Brazil;
gabriel.arquelau@redes.unb.br (G.A.P.R.); robson@redes.unb.br (R.d.O.A.); flavioelias@unb.br (F.E.G.d.D.);
desousa@unb.br (R.T.d.S.J.); jrgildasio@gmail.com (G.A.d.O.J.)
Group of Analysis, Security and Systems (GASS), Department of Software Engineering and Artificial
Intelligence (DISIA), Faculty of Computer Science and Engineering, Office 431, Universidad Complutense
de Madrid (UCM), Calle Profesor José García Santesmases, 9, Ciudad Universitaria, 28040 Madrid, Spain
Department of Convergence Security, Sungshin Women’s University, 249-1 Dongseon-Dong 3-ga,
Seoul 136-742, Korea; taihoonn@daum.net
Correspondence: javiergv@fdi.ucm.es; Tel.: +34-91-394-7638
These authors contributed equally to this work.
Received: 20 September 2017; Accepted: 13 October 2017; Published: 18 October 2017
Abstract: Any network connected to the Internet is subject to cyber attacks. Strong security measures,
forensic tools, and investigators contribute together to detect and mitigate those attacks, reducing
the damages and enabling reestablishing the network to its normal operation, thus increasing the
cybersecurity of the networked environment. This paper addresses the use of a forensic approach
with Deep Packet Inspection to detect anomalies in the network traffic. As cyber attacks may occur
on any layer of the TCP/IP networking model, Deep Packet Inspection is an effective way to reveal
suspicious content in the headers or the payloads in any packet processing layer, excepting of course
situations where the payload is encrypted. Although being efficient, this technique still faces big
challenges. The contributions of this paper rely on the association of Deep Packet Inspection with
forensics analysis to evaluate different attacks towards a Honeynet operating in a network laboratory
at the University of Brasilia. In this perspective, this work could identify and map the content and
behavior of attacks such as the Mirai botnet and brute-force attacks targeting various different network
services. Obtained results demonstrate the behavior of automated attacks (such as worms and bots)
and non-automated attacks (brute-force conducted with different tools). The data collected and
analyzed is then used to generate statistics of used usernames and passwords, IP and services
distribution, among other elements. This paper also discusses the importance of network forensics
and Chain of Custody procedures to conduct investigations and shows the effectiveness of the
mentioned techniques in evaluating different attacks in networks.
Keywords: cybersecurity; network security; traffic analysis; deep packet inspection; intrusion
detection; network forensics
1. Introduction
It is no longer possible to consider business and government services without the use of the
Internet. The impressive growth rate of the Internet and its technologies allows many companies and
government agencies to provide their services online, bringing more practicality to users. This growth,
Appl. Sci. 2017, 7, 1082; doi:10.3390/app7101082
www.mdpi.com/journal/applsci
Appl. Sci. 2017, 7, 1082
2 of 29
however, also results in a more frequent occurrence of cyberattacks that impact users and business,
such as to shut down victims’ servers or steal critical information from attacked networks.
For most applications, especially those considered critical (e.g., Internet Banking), having its
assets compromised or being forcibly off for a period is inadmissible because it represents revenue
loss. It has become clear that, not only when attacked, one must have early detection and mitigation
techniques to minimize damages and recover normal operation as fast as possible. This early detection
can be achieved with the use of advanced network tools and analysis in conjunction with skilled
people within the cybersecurity domain.
One approach to investigate network attacks is the use of Deep Packet Inspection (DPI).
Basically, this technique consists of a thorough examination of the fields contained in the packets
that flow within the investigated network. It allows for detecting anomalies into the network flow,
along with the other important information that is useful when dealing with incident response, such as
the IP address involved, type, time and duration of the attack, along with other data that helps security
professionals to mitigate incidents.
Network forensics is used to identify and generate evidence against attacks that can be related to
the commitment of crime such as the stealing of information that is not publicly available. Although
it may not always be the case, it is important to gather and examine evidence as if they were to be
used in court. Having such assumptions in mind, it is important to follow Chain of Custody (CoC)
procedures when dealing with incident response and cyberattack mitigation.
This paper provides DPI and analysis of network traffic data obtained from a Honeynet
maintained for research purposes in a network laboratory at the University of Brasilia. This data was
analyzed to evaluate the behavior of attackers, the content and other characteristics of some attacks
directed to the environment.
The main contribution of this paper is to provide a characterization of real attacks using DPI to
evaluate the modus operandi of some bots (i.e., W32.IRC), botnets (i.e., Mirai), evaluation of brute-force
attacks’ behavior conducted either by humans or bots providing distribution statistics of the source of
the attacks, protocols used and link analysis of the data.
The remainder of this paper is organized as follows. Section 2 provides a review of the DPI
technique and researches within the traffic analysis and network forensics domain. Section 3 describes
techniques used to detect network anomalies using DPI. Section 4 shows the results obtained against
real attacks traffic data using DPI and network forensics procedures. Section 5 concludes this paper.
2. Review of the State of the Art about Packet Analysis and Related Work
Inspection of packets in a network flow can be performed in various depths for different purposes.
It is considered a common practice in network security analysis and is widely used by cybersecurity
experts. The following subsections present some review of the state of the art and a brief related work.
2.1. Deep Packet Inspection
Although it faces many challenges, application of DPI for security purposes has proven to be
effective and it is a technique whose utilization is expanding [1]. Packet inspection refers to the ability
to analyze network traffic for a given purpose, be it in a real-time scenario or in an offline analysis.
This kind of inspection may vary depending on its depth.
As stated by Parsons [2], Shallow Packet Inspection (SPI) is the examination of the headers of
every packet, but not the payload, focusing on layers 2, 3 or 4 regarding the TCP/IP stack. This kind of
inspection is often used in firewalls that compare the source or destination addresses against a blacklist,
for the sake of deciding to let a packet pass or drop it.
Conversely, Medium Packet Inspection (MPI) examines the headers of the packet and the
presentation layer of its payload that can be compared against a list. This inspection is commonly used
by application proxies and provide a more thorough analysis, being able to determine, for instance,
some file formats and thus filter packets based not only on their IP addresses.

Appl. Sci. 2017, 7, 1082
3 of 29
On the contrary, when using DPI, all of the headers of all layers and the payload are prone to be
checked. With DPI, it is possible to detect well-known malware signatures and network anomalies
that may be considered attacks. DPI allows for identifying the IP source of an attack, anomalies in the
payload, intentions and goal. In conjunction with the network flow, it is a powerful tool to understand
the sequence of an attack, steps the attacker may have taken and other techniques that may have been
used. With DPI, it is possible to evaluate new exploitation techniques in networks; thus, it allows
researchers to create new defense mechanisms and signatures.
Table 1 shows the different depths of the packet inspection (SPI, MPI and DPI) and the layers up
to which they reach. From levels one to four, the inspection consists of an analysis of the headers of the
packets, whilst from levels five to seven, the analysis is performed in the payload [2].
Table 1. Different depths of packet inspection and the OSI and TCP/IP layer they encompass.
Level
SPI
MPI
DPI
7
6
5
4
3
2
1
OSI Model
Application Layer
Presentation Layer
Session Layer
Transport Layer
Network Layer
Data Link Layer
Physical Layer
TCP/IP Model
Application Layer
Transport Layer
Network Layer
Data Link Layer
Physical Layer
Although DPI is a more informative inspection, being more useful for the detection of anomalies,
it also produces a greater amount of data, requiring more processing and storage capacities. Nowadays,
in modern networks, a good approach to analyze the amount of information DPI creates is the use
of Big Data tools, such as Hadoop [3] and Kafka [4]. In addition, as investigation, mitigation and
incident response may take place in real time, a deeper analysis of the contents of each packet requires
better performance of the device performing the inspection. Thus, monitoring data in real time require
pipeline techniques, queues, visualization and processing power bigger than it was necessary before.
DPI can be used in many applications. It is useful for network management, by maintaining
a Quality of Service (QoS) with content optimization (treating different traffic types accordingly to
provide required QoS), application distribution and load balancing; it also contributes to network
security and forensics, by detecting and dropping potential harmful packets trying to enter or leave the
network [5]. Other applications of DPI include network visibility, user profiling, copyright policing,
censorship or content regulation [6].
2.2. DPI Common Challenges and Requirements
Deep packet inspection is not only a powerful tool regarding network anomalies detection,
but it may also be used in bandwidth management, advertisement and copyright content filtering [7].
However, it may be used with bad purposes, such as interfering within net neutrality [8] or allowing
governmental surveillance [7] and privacy invasion [9]. Due to the nature of DPI, some limitations in its
implementation arise some challenges, requiring, therefore, a study of the viability of its deployment.
Regarding some of the most common challenges Deep Packet Inspection faces, as presented in
Table 2, its implementation, in order to be effective, should consider the attributes of the hardware
assigned to perform the inspection. Slow hardware or software may become the bottleneck in packet
processing, compromising the results that could be achieved. To allow the implementation of these
devices in high speed networks, existing studies focused on improving their performance with
algorithms that integrates CPU and GPU [10]; hardware acceleration [11]; and new architecture for
DPI devices [12].
Appl. Sci. 2017, 7, 1082
4 of 29
Table 2. Resume of DPI common challenges.
Challenges
Description
Supporting References
Performance
When monitoring a network in real time, the device assigned to
perform the DPI should be able to process the packets
information in the least time possible, for it to be capable of
analyzing every packet of the flow, without accumulated delay.
Optimizing the use of the memory of the device, for instance,
improves the performance. As internet traffic generates a huge
amount of data, its processing may require tools specialized for
Big Data, such as Hadoop and Kafka.
[3,4,13]
Encryption
As DPI consists of the analysis of the payload and headers of
each packet, encrypting it hinders the detection with DPI, it being
possible to analyze only the metadata. In such cases, solutions
include the use of proxies which can decrypt the traffic, in cases
where it performs Man-In-The-Middle (MITM) transactions on
behalf of users, or analyzing packets after they are decrypted.
[14–16]
Anonymity
Cases in which the attacker uses network anonymizers, such as
The Onion Router (TOR), will lead the DPI investigation to an
inaccurate conclusion regarding the source of the attack.
Spoofing packets will also masquerade its source.
[17–19]
Number of
attacks
With the increasing number of different attacks, thorougher
inspections are necessary to detect their patterns and signatures,
and keep the database updated. In addition, as zero-day
vulnerabilities may occur at any time, a more detailed
investigation is necessary in order to identify and follow the
attacker’s trail. To circumvent this, Machine Learning techniques
may be applied, to detect known and emerging malware.
[20–22]
The implementation of DPI devices may vary according to requirements specific to the technology
in use. Bouet et al. [23] described the implementation of Deep Packet Inspection in a Software-Defined
Network (SDN) and proposed a method for reducing the network load and improve the efficiency of
the devices, significantly reducing the implementation cost.
When deployed for network forensics, the inspection depends on a good localization of the
network sensors. In turn, it depends on what information from the network is wanted and may vary
from inbound or outbound interfaces, pre-Network Address Translation (NAT) or post-NAT traffic,
behind or in front of a firewall, and so on, in relation to the nature of the data wished to be checked [24].
Encrypted traffic also poses a challenge to DPI and should be considered prior to its implementation.
Deep packet inspection and encryption are discussed in more detail in Section 2.4.
2.3. Network Forensics and the Cybersecurity Market
Internet traffic grows rapidly, with an expectation of 278 Exabytes of data being transmitted per
month by 2021 (see Figure 1), as stated in [25]. As DPI is correlated to network traffic, this growth
also implies a higher amount of DPI devices used in the several different types of its applications and
segments. Major factors for the DPI market expansion are evolution of cyberattacks, which influences
the need for modern and good performance network analysis devices and advancements in the
communication technology.
As a consequence of this growth, there is an increased occurrence of cyberattacks and more money
being invested by companies to secure their assets, as a data breach may cost millions of dollars and
result in a loss of market [26]. Figure 2 shows that the security alerts has risen from 2013 to 2016. It is
possible to see a spike of alerts in 2015, evidencing an explosion of attacks in that year [27], which can
be verified by the Symantec Report [28], which shows an increasing appearance of, among other
threats, new mobile malware variants and a higher rate of e-mail malware in recent years.
Appl. Sci. 2017, 7, 1082
5 of 29
As reported by a Cisco Report [27], with the advent of new technologies, such as Internet of
Things (IoT), the attack surface will only expand, giving malicious users more space to operate.
As a consequence, the use of DPI is expected to grow, in order to prevent targeted networks from
being exploited [29]. One of the biggest reasons for this rise is the growing trend of ransomware,
which are dominating the malware market, partially due to the use of bitcoins as the preferred method
of payment, as it grants anonymity to its users. This lucrative threat became more widespread and
powerful in the first half of 2016, targeting individual and enterprise users with a high success rate [29].
The recent worldwide infection of WannaCry [30] corroborates the ascension of this kind of malware.
As this type of malware depends on a private key to conclude the encryption, DPI can be used to
detect and drop suspected egress traffic, matching ransomware’s communication protocols.
Figure 1. Global IP traffic forecast for up to 2021—Compound Annual Growth Rate (CAGR) [25].
Figure 2. Cumulative annual security alert totals [27].
As claimed by Morgan [31], the worldwide investment in cybersecurity will increase from
$75 billion, registered in 2015, to $170 billion in 2020. The expectation for the DPI market is to
grow at a CAGR of 21.6% from 2016, $7.01 billion to 2021, and forecast of $18.60 billion [1].
Appl. Sci. 2017, 7, 1082
6 of 29
2.4. Related Research about Deep Packet Inspection
DPI may present a low detection rate for some attack categories. In order to try to increase
this performance and decrease the false positive rate, Guo et al. [14] combined DPI and Deep Flow
Inspection, which is considered a macroscopic analysis of the network traffic. As this technique does not
read the packet’s content nor headers, it is more effective than DPI when detecting encrypted packets
or unknown protocols, increasing significantly the detection rate of probing and Denial-of-Service
(DoS) attacks.
Encrypted data represents a challenge for DPI because the contents can not be identified, impeding
the pattern matching. Sherry et al. [15] proposed a solution named by the authors as BlindBox,
which consists of a rule generator. This technique generates malicious signatures according to the
encryption key and a middlebox, which compares the rules against the packets’ payload. With this,
approach attacks using Secure Sockets Layer (SSL) could be identified.
Despite the BlindBox capacity to perform DPI in encrypted traffic, Yuan et al. [16] say it is currently
unpractical due to to its expensive connection setup and propose a different system architecture to
implement DPI in encrypted packets, preserving the privacy of the clients and increasing the amount
of processed packets per second. To achieve this, they parse and encrypt packet payloads into tokens,
which are fed to an encrypted rule filter and, using searchable encryption techniques, detect and act in
response and in accordance with the suspicious traffic.
Besides the encrypted traffic, anonymizers also interfere within an investigation, impeding the
determination of the source of given events. An example of such service is The Onion Router (TOR),
which contributes to malicious people spreading malware and committing crimes. Saputra et al. [17]
developed a system, consisting of DPI, to detect TOR’s characteristics in packets, to drop it and avoid
potential malicious traffic.
Such devices are commonly deployed in networks with dedicated resources, each requiring a copy
of the data from network [32], and, as this data rapidly grows in high speed networks, processing and
storing multiple copies of it may require expensive software and hardware resources. Ashraf et al. [32]
introduced a Service-Oriented framework for heterogeneous Deep Packet Inspection and Analysis,
which is capable of providing DPI services with a single copy of data, reducing significantly the CPU
and memory utilization.
As DPI systems inspect all the contents of a packet, from any protocol, it is necessary to
have a variety of rich and specific dissectors, which implies burdensome work for developers and
may result in software vulnerabilities, such as the one identified as CVE-2014-4174, in Wireshark
(1.10.x before 1.10.4), which allows attackers to execute arbitrary co…
Purchase answer to see full
attachment