1. Visualization tool for network forensics analysis using an Intrusion Detection System ( Cyber ViZ )

2.  Project ID: - PIT-58  Project Team:-  Project Coordinator:-Mr. Jayantha Amaraarachchi  Project Supervisor: -Mr. Lakmal Rupasinghe  Date of Submission: -5th May 2009 DIT NumberName DIT/06/E1/2022Abeyrathne K.B. DIT/06/E1/2028Yaparathna Y.M.P.K.B. DIT/06/E1/2025Ilangarathna I.M. DIT/06/E1/2008Wadigamangawa A.H.M.S.D.B. DIT/06/E1/2017De Silva D.P.H.R. Our Team Members … CyberViZ 2 Presenter : D.P.H.R. De Silva

3.  System Flow  Use Case Diagram  Functional and Non functional requirements  Detail Design  Design Constraints  Technology 3 Organization of Presentation CyberViZ Presenter : D.P.H.R. De Silva

4. Introduction …  What is network forensic visualization?  Network Forensics is used to find evidence of such Attacks  Recognize Threats through the IDS  Benefits of Visualize Network Traffic  Provide better way to collect evidence 4 CyberViZ Presenter : D.P.H.R. De Silva

5. 5 CyberViZ System Flow Presenter : D.P.H.R. De Silva

6. Use Case Diagram 6 CyberViZ Presenter : Y.M.P.K.B. Yaparathna

7.  Configure IDS  Update IDS details  View IDS details  View log report  Clear log report  Clear forensic log  View forensic log  View Forensic visualization details  View on-demand visualization details 7 CyberViZ Functional Requirements Presenter : Y.M.P.K.B. Yaparathna

8.  Reliability Reliability of the system depends greatly on the reliability of the network.  Availability The project team is designing the system for uninterrupted availability. 8 Cyber ViZ Non-Functional Requirements Presenter : I.M. Ilangarathna

9. Non-Functional Requirements  Security The log database should be saved in a secured place in a secure manner.  Maintainability The system user should update the IDS rules database & the log database regularly. 9 CyberViZ Presenter : I.M. Ilangarathna

10. 10 Detail design Intrusion Detection System CyberViZ Presenter : I.M. Ilangarathna

11. Detail design contd… 11 Forensic Agent CyberViZ Presenter : K.B. Abeyrathne

12. 12 Detail design contd… Visualization Module CyberViZ Presenter : K.B. Abeyrathne

13. ARP Spoofing & Man in the Middle Attack 13 CyberViZ Presenter : K.B. Abeyrathne

14. 14 CyberViZ ARP spoofing detection by monitoring ARP cache Presenter : K.B. Abeyrathne

15. Suspecting a ARP poisoning 15 CyberViZ Presenter : K.B. Abeyrathne

16. Design Constraints  More detailed view should be provided to the user when visualizing in order to conduct a forensic investigation  Integrity of the network traffic logs should be maintained  Should capture more than basic network traffic details 16 CyberViZ Presenter : A.H.M.S.D.B. Wadigamangawa

17. 17 CyberViZ Presenter : A.H.M.S.D.B. Wadigamangawa

18. Benefits  Simplify network forensic analysis through less complex visuals.  Integrating an IDS with a network visualization tool for network forensic analysis to be more convenient  Detecting network attacks through the forensic analysis which cannot be detected by a normal IDS 18 CyberViZ Presenter : A.H.M.S.D.B. Wadigamangawa

19. System Requirements 19 CyberViZ Hardware Requirements For efficient performance of the system, the following hardware is required. PCs running Windows XP at a minimum speed of 1.0 GHz and recommended 512MB of Ram with Network Interface card Software Requirements Snort IDS Winpcap MySQL Presenter : A.H.M.S.D.B. Wadigamangawa

20. Thank You …