This project introduces you to practical techniques for distinguishing between legitimate and malicious network traffic. Network operators frequently perform this task to ensure network security and detect potential threats.
In this project, you will analyze a pcap file (evaluation.pcap) that contains network traffic from multiple hosts. This file includes a mix of legitimate and malicious traffic. Your task is to investigate the traffic patterns using Wireshark and then create Snort rules to automatically differentiate between benign and malicious activity.
By completing this project, you will gain hands-on experience with:
● Understanding and analyzing different types of network traffic.
● Using Wireshark to inspect packets and detect suspicious activity.
● Writing Snort rules to identify malicious traffic based on predefined attack patterns.
● Running Snort to test your detection rules and generate alerts when malicious activity is found.
Through this process, you will develop a deeper understanding of network security monitoring, intrusion detection systems (IDS), and the fundamentals of network forensics.
Getting Started
If you’re already familiar with the tools, you can skip to and focus on the following sections:
However, reading through the full document will give you a better understanding of what you’ll be working on. Before you post any questions on Ed, please read this document thoroughly.
Definitions and Traffic Collection Set-up
This assignment includes four distinct attack scenarios. Each scenario is based on a predefined network topology, where the attack originates from one or more machines outside the target network.
The network is a standard LAN topology hosted on the AWS computing platform. All hosts are behind NAT, and their IP addresses fall within the 172.31.0.0/16 subnet. The figure below provides a visual representation of the network setup and how traffic is collected.
Figure 1: Network setup for traffic collection.
Types of attacks:
(i) Distributed Denial of Service (DDoS):
In a DDoS, attackers usually keep making full TCP/UDP connections to the remote server. They keep the connection open by sending valid HTTP requests to the server at regular intervals but also keep the sockets from closing. Since any Web server has a finite ability to serve connections, it will only be a matter of time before all sockets are used up and no other connection can be made.
Your need to identify which one of the following DDoS variants is present in evaluation pcap:
(a) GoldenEye Denial of Service
(b) Low Orbit Ion Cannon (LOIC)
(c) High Orbit Ion Cannon (HOIC)
We do not have a sample pcap provided for ddos.
Tips:
– Focus on traffic frequency (packets per second) and do a comparison with the TCP traffic you observe or the UDP traffic you observe.
– Avoid using frame.time_relative since the packets have randomized time deltas.
– Detection_filter is optional but strongly recommended; precision matters more than method
– The direction that you are tracking with a detection filter does matter!
– Keep the time period configuration as ‘seconds 1’ if you use detection_filter.
– DDoS may be the most challenging part of the project here —Feel free to share some other tips you find helpful for your DDOS on Ed without giving out your answer!
(ii) Connection attempt flood:
In this dataset, an attacker host repeatedly initiates TCP connections to a remote access service on a victim host. Your task is to determine whether the evaluation PCAP contains a connection-attempt flood targeting FTP (TCP/21) or SSH (TCP/22).
In addition to identifying the targeted protocol, you must capture and describe the relevant traffic behavior associated with the flood in order to receive full credit. This may include a high rate of connection attempts from the same source, repeated TCP handshakes or connection initiations, unusually short-lived or incomplete connections, repeated connection resets/terminations, and any protocol-level artifacts visible after a connection is established.
We do not provide a sample pcap for this category. You are expected to research and understand the differences between FTP and SSH traffic, including how brute-force attempts may manifest differently in each protocol.
(iii) Web Attacks:
The evaluation PCAP contains web application attack traffic. You must determine the specific attack technique (e.g., XSS, SQL Injection) based on HTTP behavior and payload analysis. There is only one of those types that you need to capture with your rule.
(a) XSS-based: An attacker might try to inject malicious scripts.
(b) SQL Injection: An attacker might try an SQL injection attack.
(iv) Botnet:
Botnets enable infected machines to communicate with command-and-control (C2) servers in order to receive instructions or exfiltrate data.Your task is to determine which botnet family is present in the evaluation PCAP based on observed network behavior and traffic patterns.
The botnet may exhibit characteristics such as: Periodic communication with a C2 server, use of specific HTTP methods (e.g., POST-based C2), file upload/download behavior, beaconing patterns etc,
Tips: Analyze the packet contents in Wireshark to identify malicious HTTP traffic. The sample pcaps we provided should be sufficient to guide you through this part of the project.
NOTE:
If you are losing 5 points because the autograder says you are hardcoding the IPs, we will give those points back after the project deadline. We are not penalizing students for hardcoding the IPs in this assignment. The autograder will be updated shortly to reflect that as well.
Sample traffics:
For each type of traffic mentioned above, we provide a sample of that category/type of traffic. These samples are only for illustration purposes. These samples are only examples, and they are not the same as the actual traffic that is included in the evaluation pcap, which the students will need to label.
● Legitimate background traffic:
For this exercise, we assume normal traffic to include HTTP, DNS. An example of normal (attack free) traffic can be found in:
○ sample_background.pcap
● BruteForce/Connection Attempt Flood:
○ sample_bruteforce_ftp.pcap
○ We do not provide a sample bruteforce ssh pcap. If you see that in the folder, you can ignore that file.
● Botnet:
The host generates this traffic explicitly to communicate with a C&C server. The host communicates with the C&C server to receive commands, updates, etc.
○ sample_bot.pcap
● Web Attack:
○ sample_web.pcap
○ sample_xss.pcap
○ sample_sqlinjection.pcap.
● DDoS:
○ We do not provide a sample. Please look at the example Snort rules on DDoS in the resources section.
Important Links
Project file links:
● Link to the VM:
○ Windows, Linux, Intel-based Macs: link (Dropbox password: cs6262)
○ ARM-based / M-series Mac:
OVA format for VirtualBox [link] (Dropbox password: cs6262)
For UTM / qcow2 users please convert the ova to qcow2 format.
We tried but the resulting file is 18GB, too big to download well.
○ VM Login: Username: snortstudent Password: 6262student
NOTE: Be sure you aren’t logging in as the swarm user! That’s for the SWARM project.
● Packet capture file (evaluation.pcap)
○ You already have a copy inside the VM. However, we recommend downloading this file and analyzing it with Wireshark on your local machine, as processing the pcap within the VM may take longer.
○ You can share the files between your host machine and the VM (In your VM, device-> share folders. Select the host machine folder that you want to mount. You can find the shared folder under the media path. ChatGPT is your friend here if you don’t know how to set up the file sharing.)
● Sample pcaps – sample_pcap.zip. Please use your Georgia Tech account to access this link.
Project Tasks (100 points):
The goals:
(i) Explore the given pcaps in Wireshark and identify the attack traffic patterns.
(ii) Write Snort rules to raise alerts to identify the attacks.
Step by Step Instructions towards the goals:
- Don’t panic, we provide all the commands you need and all the steps you need to follow in this section. Plenty of tips and guides in the Definitions and Traffic Collection Set-up section.
- Install Wireshark in your local machine:
○ https://www.wireshark.org/download.html
○ We provide a project VM, but we highly recommend inspecting the pcap files with Wireshark on your local machine for better performance. The VM can be resource-intensive when processing large files.
- Files/Download: The local set-up can be found in the “Important Links” section and contains,
■ The Snort configuration file snort.lua is already on the virtual machine (VM)
■ The python file count.py is on the VM, you can use various editors like nano, vi or the GUI based text editor on the VM to view it.
- Locate the pcap files
○ The evaluation.pcap file you downloaded.
○ Create an eval.rules file in the same directory to write your Snort rules.
■ Please pay attention to the deliverable section for what is required for gradescope submission. It should be rules.py (you just need to change the rules file name before you submit on GradeScope).
- Make observations on the pcaps. Observe the sample pcaps to get an idea about how each type of malicious traffic looks like. You can use Wireshark or tshark to isolate some traffic. For example, in Wireshark, you can apply display filters. For e.g., tcp (to display only TCP traffic), ip.addr == 10.0.0.1 (to display traffic that originates from or is destined to this IP address). Also, you can combine filters using or/and.
You should use the attack descriptions above – to understand how these attacks should look like in network traffic.
- Write Snort rules:
○ Create a new file named eval.rules and write your Snort rules inside it.
○ Use Snort 3 (not Snort 2), as this project is designed for Snort 3, which is pre-installed in the VM.
○ Example Snort rule:
| alert tcp 172.1.2.3 any -> any any ( msg:”A packet from 172.1.2.3 to any ip:port”; sid:1; ) |
○ Ensure correct alert messages – Each Snort rule must use exactly one of the following messages:
1. DDoS
2. Flood
3. WebAttack
4. Botnet
Example: If detecting an DDoS, use:
| msg:”DDoS”; |
Notes: Incorrect alert messages(eg. casing) may result in point deductions.
You might need 4-5 rules for this project. We do not limit the amount of rules you use, but you
should be able to complete the project with 4-5 rules.
- Run Snort rules:
This helps you to generate the alert_fast.txt file.
Inside the VM please run the following Snort command:
| snort -c ~/snort.lua -r ~/evaluation.pcap -R ~/eval.rules -s 65535 -k none -l . |
Be aware that there is a “.” included at the end of the command. (Change the directory if necessary)
- Evaluate Your Results:
Run the command below to check the unique connections (create the count.py linked above):
| python3 ~/count.py alert_fast.txt |
This generates a connections.txt file summarizing attack types and unique connection counts
Common errors after running count.py:
● JSONDecoderError – This occurs when the file is too big for python to handle. Your rule is likely too broad and generates too many alerts; refine it to reduce false positives.
● Comments: {‘unknown message: abc’} – This occurs when your snort alert raises a message that count.py doesn’t expect. Ensure your msg fields are one of: DdoS, Flood, WebAttack, Botnet. The grader/script is looking for the attack types to be spelled/capitalized exactly the way we described.
● If you don’t see “Attack type: …, unique connections: …” for a particular attack but see it for others – This means your snort rule was too strict/incorrect and filtered out all connections.
● Remember to delete the previously generated connections.txt file when you make a new run.
Deliverables/Rubric:
What to Submit?
Submit the following Two files on Gradescope
1. rules.py – This is where you paste your Snort rules. This is for us to grade your rules! Just copy and paste what you have in eval.rules into rules.py (create a new text file and name it rules.py). We name this a py file for grading purposes.
○ 10 points will be deducted if this file is missing. The minimum score for the project is 0. If you get a -10 as your final grade, the grade will be adjusted manually later.
2. connections.txt – This is the resulting file generated by running `python3 count.py alert_fast.txt`. Do not change the connections.txt file manually! It must match the output from the script.
Submission Notes
● Incorrect or missing files will lead to a 10 point grade deduction per file
● There is a limit on the number of submissions on gradescope. Please refer to “How to validate your answer” in the session below.
● Don’t zip the file. Just upload them as separate files. Make sure the filename is correct.
● All the late submissions will be on Gradescope. You do not need to make a post on Ed.
How to Validate Your Result?
- We consider a connection to be “src_ip:src_port:dest_ip:dest_port”. You can utilize the `count.py` to check the unique connections of your alert_fast.txt. You can compare the number of DDoS/Flood/WebAttack/Botnet you got with the statistics below. If the number is close, you are likely on the right track.
- You can view the pcap file in Wireshark to confirm you are finding the right connections.
- Last, you can verify your result by submitting your answer to the gradescope (See steps 4&5). As the number of trials is limited, perform step 2 first!
- Submission limit:
- You can submit up to 10 times on Gradescope.
- We recommend to have all your rules ready before you try out on gradescope.
- Running a single snort rule against the evaluation.pcap can get a different result when you run it along with other snort rules. This is related to the limitation of Snort. So please run all your rules together to get the result we want.
Grading
Your Snort rules file will be evaluated using an autograder based on four attack categories:
| Attack Category | Weight (%) |
| DDoS | 25% |
| Flood | 25% |
| WebAttack | 25% |
| Botnet | 25% |
– There are 4 attack categories as described above, each of which carries 25% grade weight.
– For each attack category, your grade = #correct alerts / (#real correct alerts + #incorrect alerts). Therefore, if you raise alerts for packets that are benign as one of the attack categories (false positives), you will lose points for that attack category. Also, if you miss raising an alert for an attack packet, you will lose points for that category.
– We will calculate your final grade for each category (which has 25 points as a full mark) by #final grade = min(25, #grade-for-one-category * 125%), which means if you catch 80% of the attacks correctly, you can get full marks for the category.
Statistics for each type of unique connections (Important!):
(The number might be a little different when you try to find it in Wireshark. Use the number that Snort gives you)
We consider a connection to be “src_ip:src_port:dest_ip:dest_port”.
Run “python3 ~/count.py alert_fast.txt” to check the unique connections of your alert_fast.txt and generate the results in `connections.txt`. If your alert JSON file is generated in the home directory, you might need to add sudo in front of your command.
FAQs
Getting Started
- This all seems too hard, how do I start?
– Identify the attack from the list of possible attacks for each section. Once you have identified the attack, analyze the attack traffic packet headers (HTTP/TCP headers), and identify the common characteristics in the attack traffic. Use this information to craft your Snort rule.
Rule Development & Behavior
- Why did my rule change the number of packets captured for a particular attack when I added a rule for a different attack?
– If rules are too generic, they capture a broad range of packets leading to possible shadowing of other rules. If you do not see the output for a rule or you see that the count has changed, make sure you double check all your rules to ensure they are not too generic.
- I am not seeing the exact count for the DdoS and Bruteforce/connection attempt flood rules as listed in the writeup.
– DdoS and Bruteforce/Flood are volumetric attacks. Thresholding can help tune out benign traffic. You are not expected to match the numbers in the writeup for these attacks. If you are within a ~10-15% margin of the number in the writeup(i.e. you have a rule that can successfully identify attack traffic from benign traffic), you will be awarded full points.
- What are volumetric attacks and what do I do about it?
– DdoS and Bruteforce/Flood attacks rely on a large number of requests in their attacks. These attacks generate a high volume of attack traffic. Content filtering might not be the best course of action. To identify such attacks, use the I/O graphs and threshold filters!
- Everytime I run my rules, the number of connections identified for the Bruteforce/Flood traffic changes. Why is this?
– This is related to how Snort parses packets and is expected behavior. Therefore, we provide a margin of ~10-15%
Grading and Credit
- Do I get partial credits if the snort rule is not 100% correct?
– Partial credit is awarded according to how many false positives are detected. Please refer to the grading algorithm above.
Tools and Resources
- Do you provide sample pcaps for Ddos?
– No, we don’t provide sample pcaps for dos because you can observe dos from the evaluation pcap. A good start is reading some existing snort rules for detecting dos attacks to get a sense of it.
- After grading this assignment, will you release the correct answers?
– No, we don’t, since similar projects run across semesters.
- Should we ignore instances of ICMP and IP?
– You can ignore ICMP & IP
- Is Tshark/Wireshark installed on the virtual machine?
– Yes. If the VM is too slow for you, I would recommend you install pcap reading tools on your local machine and use the VM only for Snort. ‘evaluation.pcap’ is a very large file so it can take some time to load. You may need to increase the amount of RAM available to the system to get it to display properly.
- Looks like I can complete the assignment without using VM?
– Correct, you can complete without the VM but make sure your snort file works with the version installed in the given VM. (Snort 3)
Definitions and Behavior
- What defines a “connection”?
– A “Connection” is identified by its Source Address, Destination Address, Source Port, and Destination Port.
- Any hints on what we should look for when trying to identify SPAM-ing? SMTP connections?
– You may want to look at packets within a certain time frame.
- Can attacks be only from one or two machines or it should be from massive bot machines?
– It can be from any number of machines. The exact number is not relevant.
- Should we include an IPV6 connection? or only IPV4?
– Only IPV4
Submission and Validation
- We don’t need to zip the file when we submit, right?
– No, you just need to submit the two files separately: rules.py and connections.txt.
- Is it possible to get 100% just using rules derived from samples?
– We can’t confirm or deny. 🙂
The sample pcaps are there to give you a good idea, but we don’t claim they’re representative. You should learn the pattern in the sample pcap and try to find related or similar patterns in the evaluation pcap. Always manually verify that what you find is correct.
- I am getting some json error/json decoder error
– Yes that means your json file is too big and maybe you need to put more constraints on your snort rule to generate a smaller json file.
- I am seeing empty alert.json file
– delete the previous alert_fast.txt, if any
– delete the previous connections.txt, if any
– ensure each command in your file has a unique SID.
- Why am I getting many more connections than necessary in DdoS and how should I lower it?
– Try using the frequency as a filter type. Remember that the direction of tracking matters (by src VS. by dst)
Resources:
Readings on botnets behavior: Please read through the following papers, to get an understanding of what a bot is, and how botnets behave. Please note that we are not asking you to implement the proposed methodologies, e.g. a machine learning method to detect bots.
● ”BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation”, Gu et. al. http://faculty.cs.tamu.edu/guofei/paper/Gu_Security07_botHunter.pdf
● ”BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic”, G. Gu, J. Zhang, W. Lee, http://faculty.cs.tamu.edu/guofei/paper/Gu_NDSS08_botSniffer.pdf
● ”BotMiner: Clustering Analysis of Network Traffic for Protocol-and Structure-Independent Botnet Detection”, G. Gu, R. Perdisci, J. Zhang, W. Lee, https://www.usenix.org/legacy/event/sec08/tech/full_papers/gu/gu.pdf
Getting started with WireShark
Here is an introductory video to Wireshark so that you can get familiar with the interface: https://www.youtube.com/watch?v=qTaOZrDnMzQ
Snort resources: Here you can find some examples of Snort rules, and some resources so that you get familiar with Snort rules. The purpose of these resources is only to get you familiar with how Snort rules look like. You are expected to write your own Snort rules.
– https://usermanual.wiki/Document/snortmanual.760997111/view
When you google snort syntax, you should be aware that we are using snort 3 not snort 2. There are some subtle differences between Snort 2 and Snort 3 syntax. Snort 2 syntax might result in errors when you run your rules locally.
Example: Writing Snort rules to detect DDoS traffic: This is an example to give you an idea about how we can use our understanding of an attack, and write Snort rules with potentially long shelf life, to detect this attack. Intro reading for dos: https://en.wikipedia.org/wiki/Denial-of-service_attack. Snort for DDoS: Please read this to get a general idea about how Snort can be used for this purpose. Please focus on sections 3 and 4. After reading the above, one way to detect dos traffic is to monitor the rate of incoming traffic. Here is an example Snort rule based on traffic rate: http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node35.html
(Notice that this link is actually the snort 2 manual. However, the syntax for detection_filter is the same in snort 2 and 3. The Snort 2 manual in this case provides a better example to illustrate this filter. For other filters, especially the URL content filters, you should double check the snort 3 manual and other resources online)
Useful tools/commands:
● You can install Wireshark from here: https://www.wireshark.org/
We do recommend you to install Wireshark on your own machine for evaluation pcap analysis because the pcap file is big and your VM might be significantly slower than your laptop.
● Wireshark display filters to view part of the traffic: https://wiki.wireshark.org/DisplayFilters
Important Notes
Disclaimer for background traffic. Please note that the traffic that is found in the evaluation pcap, and/or at the Sample pcaps is not generated by us. The dataset closely resembles realist traffic. Part of this traffic might contain inappropriate content or language. We have taken extra measures and we have performed considerable effort to filter all traffic, based on commonly used inappropriate words. We have filtered the http payload and URIs. Nevertheless, it might still be possible that some inappropriate content or words might have not been filtered entirely. In case you locate such content, we are letting you know that it is not intentional, and we are not responsible for it. Also, to complete this assignment, you do not need (nor do we ask you) to click on URLs found inside http payloads.
Additional tools are not allowed. For the assignment, you are not allowed to use any available tools, related to Snort or others. For example, you are not allowed to use Snort preprocessors that may be publicly available, pre-compiled Snort rules, detection tools. etc. You are expected to write your own Snort rules.
Limited support for running snort locally. We have the env set up for you inside the VM. Setting up the snort 3 env on your own could be troublesome. We strongly recommend you to run snort rules inside the VM we provide (you can analyze(use wireshark) the pcap outside the VM but run the rules inside the VM).
