Preparation

[To be undertaken before attempting the online test]

This assessment builds on the work you have completed and the skills you have developed in the tutorials during the course.

Data has been provided from a newly established Network Telescope (zero interaction honeypot). You consultancy service have been contracted to help PetaNet AS understand the value of the data they have collected.

You will answer a number of questions form the organisation based on this data in the form of an Online Test as described in the following section)

Datasets

Three datasets are provided for this task:

1.       Main Network Telescope dataset

10 days of data (21-31 May 2021) is provided across a single /24 sensor using Ipv4 traffiv only. Timestamps are calculated as GMT+2.

2.         Supplementary Data

Extracts of top IP addresses and ports have been obtained from an other Researcher. These will be used as comparative sources.

3.         TI data

The Alienvault , Brute Force blocker (http://danger.rulez.sk/ and Compromised IPs TI feeds.

NOTE: You MUST use the specific files files provided

Analysis

You need to perform appropriate analysis on the provided data. As a minimum you should be able to answer the following questions:

• Provide a breakdown of traffic by hour over the 10 days.
• Be able to do analysis for the three primary protocols of TCP. UDP and ICMP
• Basic descriptive statistics as appropriate

These would include: counts of various data types; averages observed values over a period of time | including min, max and standard deviation values of observed data periods.

• An analysis of the top N (N to be defined in the Quiz)
  • – IP sources
  • – Source ports (TCP and UDP)
  • – Destination ports (TCP and UDP)
  • – ASN
  • – Countries
• An analysis of the variation of IP TTL values (as a whole and by protocol).. An example plot for simple analysis is shown in Figure 1.
• Some basic Geolocation (country level) enrichment of the complete data set.
• Topological Analysis (ASN) of a selection of the Source IP addresses

• Categorisation/comparison of traffic against the following:
  • – The Greynoise data provided in the
  • – TI datasets provided in the dataset
  • – The additional supplementary data
• Time-series analysis which will include:
  • – Breakdown by Hour or Day (NOTE hour will be the smallest time period considered for this assessment)
  • – A plot/graph of traffic – by sources/ports/volume/ (as required). An example is shown in Figure 2.
  • – Restricting analysis to a certain time period
  • – Comparing two time periods

Prepared Question

You have been asked to evaluate the possibility of using a smaller sized telescope that only uses a portion of the /24 currently in use. You should prepare to conduct analysis of a subset of your Data to be determined by a subnet (ranging from a /27 to /29) within the larger /24 used by the primary sensor. Note: this means being able to select a group of sequential IP addresses based on the subnet provided | how you do this is up to you.

Based on the subnet provided in the quiz you will need to pre-prepare the ability/process to answer the following questions relating to it:

1. How many unique sources were received for TCP/UCP/ICMP
2. What proportion of the traffic received in the complete dataset is observed
3. For the Top 10 Source IP addresses, how long it took to observe these in your given subnet as compared to the dataset overall.
4. Compare your source IP data from this subnet against a specific TI list.
5. Produce a count of the number of unique sources and average packets received per hour for a given time period. This should be in the format of a csv: date,hour,value

As an example you can try the following for the subnet: 192.129.192.64/29

The common components preparing you for this task were primarily covered in Tasks 7,8 and 10 from Tutorial 1. For network telescope data you should refer back to Task 5 in Tutorial 1. You should build on the work you did during the tutorials.

Splitting traffic

You can pass filtering parameters for the pcap data to tshark using the -Y parameter, or to tcpdump. editcap provides fast flexible functionality for splitting data by time.

NOTE: You are free to determine your analysis strategy. your analysis should be flexible enough for you to extract certain portions of your data in response to specific parameters in test ques- tions.