Department of Computer Engineering

Assignment No.2

Q1 (c) Differentiate between SHA-1 and MD5

MD5 SHA1

While SHA1 stands for Secure Hash

MD5 stands for Message Digest. Algorithm.

MD5 can have 128 bits length of message Whereas SHA1 can have 160 bits length
digest. of message digest.

The speed of MD5 is fast in comparison of While the speed of SHA1 is slow in
SHA1's speed. comparison of MD5's speed.

To make out the initial message the aggressor On the opposite hand, in SHA1 it'll be
would want 2^128 operations whereas 2^160 that makes it quite troublesome to
exploitation the MD5 algorithmic program. seek out.

MD5 is simple than SHA1. While SHA1 is more complex than MD5.

A1-1
 While it provides balanced or tolerable
MD5 provides indigent or poor security. security.

In MD5, if the assailant needs to seek out the

2 messages having identical message digest Whereas in SHA1, assailant would need to
then assailant would need to perform 2^64 perform 2^80 operations which is greater
operations. than MD5.

While SHA1 was presented in the year

MD5 was presented in the year 1992. 1995.

Q1 (d) Explain worms and viruses

ANS:

Malicious software, or malware, refers to programs that are intentionally included or inserted in a
system for a harmful purpose, such as exploiting vulnerabilities in application, utility, or system
programs. Malicious software can be divided into two categories: those that need a host program,
and those that are independent. The former, referred to as parasitic, are essentially fragments of
programs that cannot exist independently of some actual application program, utility, or system
program. Viruses, logic bombs and backdoors are examples. Independent malware is a self-
contained program that can be scheduled and run by the operating system. Worms and bot
programs are examples.

1. Computer Viruses:

A computer virus is a piece of software that can “infect” other programs by modifying them; the
modification includes injecting the original program with a routine to make copies of the virus
program, which can then go on to infect other programs. A virus can do anything that other
programs do. The difference is that a virus attaches itself to another program and executes secretly
when the host program is run. Once a virus is executing, it can perform any function, such as
erasing files and programs that is allowed by the privileges of the current user.

A computer virus has three parts:

A1-2
 ● Infection mechanism: The means by which a virus spreads, enabling it to replicate. The
mechanism is also referred to as the infection vector.
● Trigger: The event or condition that determines when the payload is activated or delivered.
● Payload: What the virus does, besides spreading. The payload may involve damage or may
involve benign but noticeable activity.

During its lifetime, a typical virus goes through the following four phases:

● Dormant phase: The virus is idle. The virus will eventually be activated by some event,
such as a date, the presence of another program or file, or the capacity of the disk exceeding
some limit. Not all viruses have this stage.
● Propagation phase: The virus places a copy of itself into other programs or into certain
system areas on the disk. The copy may not be identical to the propagating version; viruses
often morph to evade detection. Each infected program will now contain a clone of the
virus, which will itself enter a propagation phase.
● Triggering phase: The virus is activated to perform the function for which it was intended.
As with the dormant phase, the triggering phase can be caused by a variety of system
events, including a count of the number of times that this copy of the virus has made copies
of itself.
● Execution phase: The function is performed. The function may be harmless, such as a
message on the screen, or damaging, such as the destruction of programs and data files.

The infected program begins with the virus code and works as [Link] first line of code is a
jump to the main virus program. The second line is a special marker that is used by the virus to
determine whether or not a potential victim program has already been infected with this virus.
When the program is invoked, control is immediately transferred to the main virus program. The
virus program may first seek out uninfected executable files and infect them. Next, the virus may
perform some action, usually detrimental to the system. This action could be performed every time
the program is invoked, or it could be a logic bomb that triggers only under certain conditions.
Finally, the virus transfers control to the original program. If the infection phase of the program is
reasonably rapid, a user is unlikely to notice any difference between the execution of an infected
and an uninfected program.

Viruses can be classified based on their target or their concealment strategy:

1. Classification by Target

● Boot Sector Infector: Infects the master boot record and spreads when the system is booted
from a disk containing the virus
● File Infector: Infects files that the operating system considers executable.
● Macro Virus: Infects files with macro code (e.g., Microsoft Word) and is platform-
independent.

A1-3
2. Classification by Concealment Strategy:

● Encrypted Virus: Uses a random encryption key to encrypt the virus body, making it
difficult to detect a constant bit pattern.
● Stealth Virus: Specifically designed to hide itself from antivirus software, such as by using
compression to maintain the original file length.
● Polymorphic Virus: Mutates with every infection by randomly inserting instructions or
changing instruction order to vary its signature.
● Metamorphic Virus: Completely rewrites itself at each iteration, changing its behavior and
appearance to increase the difficulty of detection.

2. Computer Worms:

A worm is a program that can replicate itself and send copies from computer to computer across
network connections. Upon arrival, the worm may be activated to replicate and propagate again.
In addition to propagation, the worm usually performs some unwanted function. Worm actively
seeks out more machines to infect and each machine that is infected serves as an automated
launching pad for attacks on other machines.

A1-4
Network worm programs use network connections to spread from system to system. Once active
within a system, a network worm can behave as a computer virus or bacteria, or it could implant
Trojan horse programs or perform any number of disruptive or destructive actions.

To replicate itself, a network worm uses some sort of network vehicle. Examples include the
following:

● Electronic mail facility: A worm mails a copy of itself to other systems, so that its code is
run when the e-mail or an attachment is received or viewed.
● Remote execution capability: A worm executes a copy of itself on another system, either
using an explicit remote execution facility or by exploiting a program flaw in a network
service to subvert its operations.
● Remote login capability: A worm logs onto a remote system as a user and then uses
commands to copy itself from one system to the other, where it then executes.

The new copy of the worm program is then run on the remote system where, in addition to any
functions that it performs at that system, it continues to spread in the same fashion. A network
worm exhibits the same characteristics as a computer virus: a dormant phase, a propagation
phase, a triggering phase, and an execution phase.

The propagation phase generally performs the following functions:

1. Search for other systems to infect by examining host tables or similar repositories of
remote system addresses.

A1-5
 2. Establish a connection with a remote system.
3. Copy itself to the remote system and cause the copy to be run.

The network worm may also attempt to determine whether a system has previously been infected
before copying itself to the system. In a multiprogramming system, it may also disguise its
presence by naming itself as a system process or using some other name that may not be noticed
by a system operator.

A1-6
Q 2a) Explain Diffie Hellman key agreement algorithm. Also discuss the possible attacks on it. Consider
the example where A and B decide to use the Diffie Hellman algorithm to share a key. They choose
p=23 and g=5 as the public parameters. Their secret keys are 6 and 15 respectively. Compare the secret
key that they share. Soln:-

Diffie-Hellman is a mathematical problem that is the foundation for many cryptographic protocols.
Diffie-Hellman is one of the greatest inventions in Cybersecurity. This revolutionary algorithm was
proposed by Whitfield Diffie and Martin Hellman in 1976, enabling two entities to agree upon a secret
key without prior arrangements, even in the presence of potential eavesdroppers. Diffie-Hellman
offers a powerful solution to secure key exchange which has always been challenging and prone to
alteration, thus ensuring confidentiality and integrity in information.

Why Diffie-Hellman Key Exchange Algorithm Needed?

A key exchange algorithm is needed in communication and cryptography for several reasons:

It enables two or more parties to agree upon a secret key without exposing it to potential
eavesdroppers, the key is then used for encryption and decryption, which is vital for maintaining
confidentiality in communication.

Preserving the data integrity was also a major challenge in digital communication where data is always
vulnerable to tempering while transmission. A key exchange algorithm helps in preserving the integrity
of the transmitted data, it prevents unauthorized alteration or tampering of data during transmission.

A key exchange algorithm facilitates authentication of the communicating parties, verifies who they
claim to be, thus escalating the risk of man-in-the-middle (impersonation) attack.

Thus along with encrypting the data for maintaining the confidentiality of the communication, a key
exchange algorithm was also needed to maintain the integrity and authorized access of the
information.

Possible Attacks on Diffie–Hellman

1. Man-in-the-Middle (MITM) Attack

• An attacker intercepts and replaces public keys.

• Establishes separate keys with A and B.
• Neither A nor B realizes the communication is compromised.
2. Discrete Logarithm Attack

• If 𝑝 is small or poorly chosen, attacker can compute private keys from public values.
• Modern systems use very large primes (2048+ bits) to prevent this.
3. Replay Attack

• Old messages are resent by attacker.

• Can cause reuse of old keys if no freshness mechanism exists.
4. Small Subgroup Attack

• If 𝑔 is not properly chosen, attacker can force keys into a small subgroup and guess the secret.
Working:

Let two users, A and B:

A1-7
 1. Public Parameters (known to everyone):
o A large prime number ppp o A generator
ggg (primitive root modulo ppp)
2. Private Keys:
o A chooses secret aaa o
B chooses secret bbb
3. Public Keys:
o A computes: A=gamod pA = g^a \mod pA=gamodp
o B computes: B=gbmod pB = g^b \mod pB=gbmodp
4. Exchange Public Keys
5. Shared Secret Computation:
o A computes: K=Bamod pK = B^a \mod pK=Bamodp o
B computes: K=Abmod pK = A^b \mod pK=Abmodp

Both get the same shared key because:

K=gabmod pK = g^{ab} \mod pK=gabmodp

• p=23p = 23p=23, g=5g = 5g=5

• A’s private key a=6a = 6a=6
• B’s private key b=15b = 15b=15

Step 1: Compute Public Keys

• A computes:

A=5^6mod 23=15625 mod 23=8

B computes:

B=5^15mod 23=19

Step 2: Compute Shared Secret

• A computes:

K=19^6mod 23=2

• B computes:

K=8^15mod 23=2

Shared Secret Key = 2

Q 4a) Explain public key distribution in detial.

A1-8
Public key distribution refers to the method of securely sharing public keys among users in a publickey
cryptography system. Since public keys are openly available, the main issue is ensuring their
authenticity—that the key actually belongs to the intended user and not an attacker.

Need for Public Key Distribution

In asymmetric cryptography:

• Public keys are used for encryption and signature verification

• Private keys are kept secret

If an attacker replaces a legitimate public key with a fake one, secure communication can be
compromised (e.g., man-in-the-middle attack). Hence, reliable distribution mechanisms are required.

Methods of Public Key Distribution

1. Public Announcement

Users publish their public keys via email, websites, or public forums.

• Advantage: Simple and easy

• Disadvantage: Vulnerable to forgery and impersonation

2. Publicly Available Directory

A trusted directory maintains a list of users and their public keys.

• Advantage: More reliable than public announcements

• Disadvantage: Directory must be secure and regularly updated

3. Public Key Authority

A centralized trusted authority provides public keys upon request.

• The authority sends digitally signed keys to ensure authenticity

• Advantage: High security
• Disadvantage: Requires continuous access; may become a bottleneck

A1-9
4. Public Key Certificates

Public keys are distributed using digital certificates issued by a trusted Certificate Authority.

• Certificate contains: user identity, public key, and CA’s signature

• Widely used in secure communication protocols like TLS
• Advantage: Scalable and highly secure
• Disadvantage: Depends on trustworthiness of CA

⚠️ Security Threats

• Man-in-the-Middle Attack: Attacker intercepts and replaces keys

• Key Substitution Attack: Fake public key is used
• Compromised CA: Fake certificates may be issued
• Replay Attack: Old keys reused maliciously

A1-10
Q3. a. Explain Cryptographic hash functions with properties of secure hash function.

Ans.:
Cryptographic Hash Functions

A cryptographic hash function is a mathematical algorithm that takes an input (or message) of any
length and produces a fixed-length output called a hash value, digest, or checksum. The main
purpose of a hash function is to ensure data integrity, meaning that even a small change in input
results in an entirely different hash value.

Definition

A cryptographic hash function is a function:

H: {0,1}* —> {0,1}^n

where:

● Input can be of arbitrary length

● Output is of fixed length (n bits)

Example

If we apply a hash function (like SHA-256) to a message:

● Input: Hello
● Output: 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969

Even a small change:

● Input: hello
● Output: completely different hash

A1-11
 Fig. 3.1.1 Hash functions.

Applications of Cryptographic Hash Functions

● Password storage (storing hashed passwords)

● Data integrity verification
● Digital signatures
● Message authentication codes (MAC)
● Blockchain systems

Properties of a Secure Hash Function

A hash function is considered secure if it satisfies the following properties:

1. Deterministic

A hash function must always produce the same output for the same input every time it is executed.

● This ensures consistency in verification.

● If even one execution gave a different result, it would be unreliable.

Example:
Hash("Hello") → 8b1a9953c4611296a827abf8c47804d7

A1-12
If we hash it again,

Hash("Hello") → 8b1a9953c4611296a827abf8c47804d7

This happenes because there is a fixed algorithm, which means the processing steps will be same
and hence we will get the same output.

2. Fixed Output Length

No matter how large or small the input is, the hash function always produces an output of fixed
size. This makes the storage and comparison easier.

Example: Hash("Hi") → 64-character hash

Hash("This is a very long message") → 64-character hash
The hash will generate an output of the fixed length irrespective of the size of the input.

3. Fast Computation

A good hash function should compute the hash value quickly and efficiently for any input.

● Important for real-time applications like password verification and digital signatures. ●
Even large files should be hashed in a short time.

Example: Hash("Hello") → computed instantly

Even large files can be hashed in milliseconds since they are computationally efficient and generate
outputs quickly.

4. Pre-image Resistance (One-Way Property)

It should be computationally infeasible to determine the original input from its hash value.

● Given: H(x)H(x)H(x), finding xxx should be extremely difficult.

● This property ensures security of stored passwords.

Example:
Given: 5d41402abc4b2a76b9719d911017c592

Find input? → Not possible practically

This is because the input should be protected in such a way that it becomes computationally
infeasible to find the original value. This ensures confidentiality.

A1-13
5. Second Pre-image Resistance

Given an input x1x_1x1 , it should be difficult to find another input x2x_2x2 such that both produce
the same hash.

H(x1) = H(x2), x1 x2

● Prevents attackers from replacing original data with other valid-looking data. ●
Ensures data integrity.

Example: Input 1: Hello → Hash A

Find Input 2 ≠ Hello → Hash A → Difficult

It is difficult to find a different input that produces the same hash as the given input. This prevents
data forgery and ensures the integrity of the input.

6. Collision Resistance

It should be extremely difficult to detect any two different inputs that produce the same hash value.

H(x1) = H(x2)

● Stronger than the second pre-image resistance.

● This is important for digital signatures and certificates.

Example: Input A ≠ Input B

But Hash(A) = Hash(B) → Very hard to achieve

It is computationally infeasible to identify two inputs using the same hash output. This prevents
duplication attacks and ensures uniqueness.

7. Avalanche Effect

A small change in input (even a single bit) should result in a completely different hash output.

● Ensures unpredictability.
● Enhances security by preventing pattern detection.

Example:

Input 1: hello123
Hash 1: 5d41402abc4b2a76b9719d911017c592

A1-14
Input 2: hello124 (only one character changed)
Hash 2: 7d793037a0760186574b0282f2f435e7

Even though the change is very small, the hashes are completely unique. This is because the
functions are designed in such a way that the input bits are mixed thoroughly and the small changes
are spread across the entire output.

8. Compression Property

A hash function converts large input data into a smaller fixed-size output.

● Helps in saving storage space.

● Makes the comparison of large data efficient.

Example: 1000-character input → 64-character hash

The hash function compresses the data into smaller, fixed-length outputs. This saves storage space
and enables efficient data handling.

Cryptographic hash functions play a vital role in modern security systems by ensuring data
integrity, authentication, and security. A secure hash function must satisfy properties like pre-image
resistance, collision resistance, and avalanche effect to prevent attacks and ensure reliability.

Q3. b. What is ICMP flood attack? Explain in detail.

An ICMP flood attack is a type of Denial-of-Service (DoS) or Distributed Denial-of-Service

(DDoS) attack in which an attacker overwhelms a target system or network by sending a large
number of ICMP (Internet Control Message Protocol) packets. The primary aim of this attack is to
exhaust the target’s resources such as bandwidth, CPU, and memory, making it unavailable to
legitimate users. ICMP is a network-layer protocol used for error reporting and diagnostic
purposes. One of its most common uses is the ping command, which sends ICMP Echo Request
messages to a host and waits for an ICMP Echo Reply. In an ICMP flood attack, the attacker
exploits this mechanism by sending a massive number of ICMP Echo Requests to the target system.
The target system attempts to respond to each request with an Echo Reply. As the number of
incoming requests increases rapidly, the system’s resources become overloaded. This leads to a
slowdown in performance, and eventually, the system may crash or become unresponsive.

Working:

1. The attacker sends a large number of ICMP Echo Request packets using multiple
or spoofed IP addresses.

2. These requests are directed towards the target system or protected network.

A1-15
 3. The network device (like a firewall or router) allows the requests to pass if
permitted by its policy.
4. The target system receives each ICMP Echo Request and attempts to respond with
an ICMP Echo Reply.
5. Due to spoofed or numerous sources, the replies either go to fake addresses or create
excessive outbound traffic.
6. The continuous flood of requests forces the target to process a huge number of
packets simultaneously.
7. This results in high CPU usage, memory consumption, and network congestion.
8. Eventually, the system becomes slow or unresponsive, denying service to legitimate
users.

Fig. 3.2.1: Working of ICMP flood attack

Types of ICMP Flood Attacks:

A1-16
 1. Simple ICMP Flood:

In this type, a single attacker sends a high volume of ICMP packets directly to the target
system.

2. Distributed ICMP Flood (DDoS):

In this attack, multiple compromised systems (botnets) are used to send ICMP packets
simultaneously, making the attack more powerful and difficult to mitigate.

3. Smurf Attack:

This is a special type of ICMP flood attack in which the attacker sends ICMP requests to a
network’s broadcast address using a spoofed IP address of the victim. As a result, many devices
reply to the victim, amplifying the attack.

Effects of ICMP Flood Attack:

● It causes network congestion and excessive bandwidth consumption.

● It increases CPU and memory usage on the target system.
● It leads to slow performance or complete system failure.
● It makes websites, servers, or applications unavailable to legitimate users.

Prevention Measures:

1. Rate Limiting: Limiting the number of ICMP packets that can be processed per second
helps prevent overload.
2. Firewall Configuration: Firewalls can be configured to block or restrict unnecessary ICMP
traffic.
3. Intrusion Detection Systems: These systems can detect abnormal traffic patterns and alert
administrators.
4. Disabling Unnecessary ICMP Responses: Systems can be configured to ignore unnecessary
ICMP requests.
5. Using DDoS Protection Services: Security services such as Cloudflare and AWS Shield
help mitigate such attacks.

An ICMP flood attack is a simple yet effective method used by attackers to disrupt network services
by overwhelming a system with excessive ICMP traffic. Proper security measures such as
firewalls, rate limiting, and intrusion detection systems are essential to protect systems from such
attack.

A1-17
Q1 (e) Explain RSA as a Digital Signature Algorithm

RSA Digital Signature Algorithm

The RSA Digital Signature Algorithm is a widely used public-key cryptographic technique
that ensures authentication, integrity, and non-repudiation of digital messages. It is based
on the RSA algorithm, which uses a pair of mathematically related keys: a public key
(shared openly) and a private key (kept secret by the owner).

In digital signatures, RSA is not used to encrypt the entire message but instead to sign a
hash (digest) of the message. This makes the process efficient and secure. It is commonly
used in secure communication systems, digital certificates, and online transactions.

Basic Concept

A digital signature is created by applying a cryptographic hash function to a message and

then encrypting the resulting hash using the sender’s private key. The receiver decrypts the
signature using the sender’s public key and compares it with a freshly computed hash of
the received message.

If both values match:

• The identity of the sender is verified (authentication)

• The message has not been modified (integrity)
• The sender cannot deny sending the message (non-repudiation)

Thus, RSA digital signatures provide trust and security in digital communication.

1) Key Generation

Key generation is the first and most crucial step in RSA. It involves generating a pair of
keys: a public key and a private key.

Steps:

1. Choose two large prime numbers p and q

 These primes should be random and kept secret

 Larger primes increase security

2. Compute n = p × q
 This value is used as part of both public and private keys
 It forms the modulus for encryption and decryption
3. Compute Euler’s Totient Function:
φ(n) = (p − 1)(q − 1)

A1-18
 Represents the number of integers relatively prime to n
4. Choose public exponent e
 Must satisfy: gcd(e, φ(n)) = 1
 Typically a small odd number (e.g., 65537) for efficiency
5. Compute private exponent d
 Calculated such that: d ≡ e⁻¹ mod φ(n)
 This means d is the modular inverse of e

Keys Generated:

• Public Key = (e, n) → shared with others

• Private Key = (d, n) → kept secret

The security of RSA depends on the difficulty of factoring large numbers into their prime
components.

2) Working of RSA Digital Signature

The RSA digital signature process consists of three main stages:

Step 1: Message Hashing

• The original message M is passed through a cryptographic hash function (such as

SHA).
• This produces a fixed-length output called the message digest (hash).

Mathematically: h
= H(M)

Purpose:

• Reduces message size for faster processing

• Ensures even a small change in message produces a completely different hash

Step 2: Signature Generation

• The sender uses their private key (d, n) to sign the message digest.
• The hash value is encrypted using the private key.

Mathematically: S
= hᵈ mod n

Explanation:

A1-19
 • Only the sender has the private key, so only they can create this signature
• This guarantees authenticity of the sender

The signature S is then sent along with the original message.

Step 3: Signature Verification

• The receiver uses the sender’s public key (e, n) to verify the signature.

Steps:

1. Decrypt the signature:

h₁ = Sᵉ mod n
2. Independently compute hash of received message:
h₂ = H(M)
3. Compare the two values:
o If h₁ = h₂ → Signature is valid o
Else → Signature is invalid

Conclusion:

 Matching hashes confirm that the message is authentic and unaltered 3)

Example

Let:
p = 3, q = 11

Step 1:
n = p × q = 3 × 11 = 33

Step 2:
φ(n) = (3 − 1)(11 − 1) = 2 × 10 = 20

Step 3:
Choose e = 3 (gcd(3, 20) = 1)

Step 4:
Compute d such that: d
≡ e⁻¹ mod 20 → d = 7
Keys:

• Public Key = (3, 33)

• Private Key = (7, 33)

A1-20
Message Hash: h
=4

Signature Generation: S =
4⁷ mod 33 = 16

Verification:
h₁ = 16³ mod 33 = 4 h₂
=4

Since h₁ = h₂ → Signature is valid

This confirms the correctness of the digital signature.

4) Advantages of RSA Digital Signature

• Provides strong authentication, ensuring the identity of the sender

• Ensures data integrity, as any modification in the message changes the hash
• Supports non-repudiation, preventing the sender from denying the message
• Does not require a shared secret key
• Widely accepted and standardized across many security protocols
• Can be integrated with Public Key Infrastructure (PKI)

5) Limitations of RSA Digital Signature

• Computationally slower compared to symmetric key algorithms

• Requires large key sizes (e.g., 2048 bits or more) for strong security
• Key generation and operations are resource-intensive
• Vulnerable if private key is compromised
• Requires proper key management and secure storage

6) Applications of RSA Digital Signature

• Secure Email Systems

Used in systems like PGP and S/MIME to sign and verify emails
• Digital Certificates (PKI)
Used by Certificate Authorities to verify identities on the internet
• SSL/TLS Communication
Ensures secure communication between web browsers and servers
• E-commerce Transactions
Protects online payments and sensitive data exchanges
• Software Distribution
Verifies authenticity of software updates and downloads
• Blockchain and Cryptocurrencies Used to sign transactions and ensure authenticity

A1-21
Q5 (a) Explain Components of IDS and its Approaches

Intrusion Detection System (IDS)

An Intrusion Detection System (IDS) is a security mechanism used to continuously

monitor and analyse activities occurring in a computer system or network. Its primary
purpose is to detect unauthorized access, malicious activities, and violations of security
policies. IDS plays a crucial role in modern cybersecurity by acting as a surveillance
system that identifies potential threats and alerts administrators, enabling timely response
and minimizing damage. It works alongside other security tools like firewalls to provide a
layered defence approach.

A] Components of IDS

1. Data Collection Module (Sensors / Agents)

The Data Collection Module is the first and one of the most important components of an
IDS. It is responsible for gathering raw data from various sources within the system or
network environment. These sources include network traffic (such as packets and flows),
system logs (operating system and application logs), and user activities (login attempts, file
access, etc.).

Sensors can be deployed in two main forms: network-based sensors, which capture and
monitor data packets traveling across the network, and host-based agents, which are
installed directly on individual systems to monitor internal activities. This module
continuously observes system behaviour and filters relevant information before sending it
to the analysis engine. The effectiveness of an IDS largely depends on how accurately and
efficiently this module collects data, as incomplete or incorrect data can lead to missed
detections.

2. Analysis Engine (Detection Engine)

The Analysis Engine is considered the core or brain of the IDS. It processes and examines
the data collected by the sensors to identify any suspicious or malicious activity. This
component uses various detection techniques such as signature-based detection, anomaly
detection, statistical analysis, and rule-based methods to evaluate the data.

The engine compares incoming data with known attack patterns and normal behavior
profiles stored in the knowledge base. If it finds any match or abnormal deviation, it flags
the activity as a potential intrusion. The accuracy and efficiency of this component are
critical, as it determines whether an activity is harmless or a security threat. Advanced IDS
systems may also incorporate machine learning algorithms in this module to improve
detection accuracy over time.

A1-22
3. Knowledge Base
The Knowledge Base acts as the memory or database of the IDS. It stores all the essential
information required for detecting intrusions. This includes attack signatures (patterns of
known attacks), baseline profiles of normal system behaviour, and predefined security
rules and policies.

The knowledge base is continuously updated to keep up with emerging threats and new
attack techniques. It allows the analysis engine to compare current system activities with
historical and predefined data to identify anomalies or known threats. A well-maintained
and regularly updated knowledge base significantly enhances the effectiveness of the IDS,
while an outdated one may fail to detect new or evolving attacks.

4. Alert and Response Module

The Alert and Response Module is responsible for generating alerts and initiating
appropriate actions when an intrusion is detected. Once the analysis engine identifies
suspicious activity, this module notifies system administrators through various means such
as warning messages, emails, dashboards, or logs.

In addition to alert generation, it may also perform automated responses depending on the
system configuration. These responses can include blocking an IP address, terminating a
suspicious session, disabling a compromised user account, or triggering additional security
mechanisms. This component ensures that detected threats are not only identified but also
acted upon promptly, reducing the potential impact of attacks.

5. Management Console
The Management Console provides a centralized interface for administrators to interact
with and manage the IDS. It allows users to monitor system activities, view alerts,
configure detection rules, manage sensors, and generate reports.

Through this interface, administrators can analyze logs, investigate incidents, and finetune
system settings to improve detection accuracy. It also supports reporting and visualization
tools that help in understanding security trends and patterns. A welldesigned management
console enhances usability and ensures efficient control over the entire IDS infrastructure.

A1-23
B] Approaches of IDS

1. Signature-Based Detection
Signature-Based Detection is one of the most commonly used approaches in IDS. It works
by comparing observed activities with a database of predefined attack signatures. These
signatures are unique patterns or characteristics associated with known threats, such as
specific byte sequences in malware or known exploit behaviors.

When incoming data matches a stored signature, the system identifies it as an intrusion and
generates an alert. This method is highly effective for detecting known attacks and is
widely used due to its accuracy and speed. However, it has limitations, as it cannot detect
new or unknown attacks (zero-day attacks) that do not yet have defined signatures.
Therefore, it requires regular updates to remain effective.

Advantages:

• High accuracy for known attacks

• Low false positives
• Fast detection

Disadvantages:

• Cannot detect new or unknown attacks

• Requires frequent updates

2. Anomaly-Based Detection
Anomaly-Based Detection focuses on identifying unusual patterns or behaviours that
deviate from the normal operation of a system. Initially, the IDS establishes a baseline
profile representing normal user and system behaviour. This baseline is created through
observation over a period of time.

Any activity that significantly deviates from this baseline is flagged as suspicious. This
approach is particularly useful for detecting unknown or emerging threats, including zero-
day attacks and insider threats. However, it may produce a high number of false positives,
as not all deviations are necessarily malicious. Proper tuning and continuous learning are
required to improve its accuracy.

Advantages:

• Can detect unknown attacks

• Useful for identifying insider threats Disadvantages:

• High false positives

A1-24
 • Requires training phase

3. Host-Based IDS (HIDS)

Host-Based IDS is deployed on individual systems or devices within a network. It monitors
internal activities such as file system changes, system logs, application behaviour, and user
actions. By having direct access to system-level data, HIDS provides deep visibility into
the internal workings of a host.

It is particularly effective in detecting insider attacks, unauthorized file modifications, and

suspicious processes. However, its scope is limited to the specific host on which it is
installed. Additionally, it may consume system resources and impact performance if not
properly managed.

Advantages:

• Detects internal threats

• Provides detailed system-level monitoring

Disadvantages:

• Limited to one system

• Consumes system resources

4. Network-Based IDS (NIDS)

Network-Based IDS monitors and analyzes network traffic across the entire network. It is
typically placed at strategic points such as routers or gateways to capture and inspect data
packets in real time.

NIDS is capable of detecting network-level attacks such as denial-of-service (DoS) attacks,

port scanning, and unauthorized access attempts. It provides a broader view of network
activity and can monitor multiple systems simultaneously. However, it may struggle to
analyze encrypted traffic and can face performance challenges in high-speed networks with
large volumes of data.

Advantages:

• Covers multiple systems

• Detects network-based attacks

Disadvantages:

• Cannot analyze encrypted traffic effectively

• Performance issues in high-speed networks

A1-25
5. Hybrid IDS
Hybrid IDS combines multiple detection approaches, including signature-based, anomaly-
based, host-based, and network-based methods, to provide a more comprehensive security
solution. By integrating the strengths of different techniques, it improves detection
accuracy and reduces the limitations of individual approaches.

For example, signature-based methods can quickly detect known attacks, while
anomalybased methods can identify unknown threats. Similarly, combining HIDS and
NIDS ensures both system-level and network-level monitoring. Although hybrid IDS
offers enhanced protection, it is more complex to design, implement, and maintain, and
may involve higher costs.

Advantages:

• Higher detection accuracy

• Detects both known and unknown attacks

Disadvantages:

• Complex to manage
• Expensive

A1-26
 Date:

Question No. 6a
Short note on Packet Sniffing. Answer:
Definition
• Packet sniffing is the process of intercepting and analyzing data packets transmitted
over a network. It allows monitoring of network traffic to understand communication
between devices.
• It is performed using specialized tools that capture packets and decode their contents,
which may include sensitive information if not encrypted.

Working Mechanism
• In normal conditions, a Network Interface Card (NIC) processes only the packets
addressed to it, ensuring secure communication between devices.
• During packet sniffing, the NIC is switched to promiscuous mode, allowing it to
capture all packets flowing through the network segment regardless of destination.

Types of Packet Sniffing

Passive Sniffing
• Passive sniffing is used in hub-based networks where data is broadcast to all
connected devices, making interception easy without altering network behavior.
• It does not generate additional traffic and is therefore difficult to detect, making it
suitable for stealth monitoring.
Active Sniffing
• Active sniffing is used in switched networks where traffic is not broadcast, requiring
the attacker to manipulate network protocols.
• Techniques such as ARP poisoning or MAC flooding are used to redirect traffic so that
packets can be captured.

Security Threats
• Attackers can use packet sniffing to capture sensitive information such as usernames,
passwords, and financial data transmitted over unsecured networks.

A1-27
 • It can also lead to session hijacking, identity theft, and unauthorized access to systems.
Prevention Techniques
• Encryption protocols such as HTTPS, SSL/TLS, and VPN should be used to ensure
that intercepted data cannot be understood.
• Using switches instead of hubs and deploying intrusion detection systems can help
minimize the risk of packet sniffing attacks.

Short note on ARP Spoofing.

Answer:

ARP Spoofing, also known as ARP Poisoning, is a type of cyber attack in which an attacker
sends fake ARP messages over a local area network (LAN). It exploits the Address
Resolution Protocol (ARP), which is used to map IP addresses to MAC addresses.

The attacker’s goal is to associate their MAC address with the IP address of a legitimate
device (such as a router), allowing them to intercept network traffic.

Effects of ARP Spoofing

• The attacker can position themselves as a Man-in-the-Middle (MITM) and intercept
all communication between the victim and the network.
• This allows data modification, session hijacking, and unauthorized access to
confidential information.

There are 3 devices:

Victim IP:
[Link]
MAC: 02:11:ab:55:ee

A1-28
Router (Gateway)
IP: [Link] MAC:
04:14:6b:21:cc

Hacker (Attacker)
IP: [Link]
MAC: 06:01:a2:52:ff

In a normal situation:

1. The victim wants to send data to the router.

2. The victim broadcasts an ARP request asking:
"Who has IP address [Link]?"
3. The router replies:
"[Link] is at MAC address 04:14:6b:21:cc"
4. The victim stores this mapping in its ARP table.
5. Communication happens directly between victim and router.

ARP Spoofing Attack Process

Step 1: Fake ARP Reply to Victim

The attacker sends a fake ARP message to the victim: "[Link]

is at MAC address 06:01:a2:52:ff"

Now, the victim believes the attacker is the router.

Step 2: Fake ARP Reply to Router

The attacker sends another fake ARP message to the router: "[Link]
is at MAC address 06:01:a2:52:ff"

Now, the router believes the attacker is the victim.

Step 3: ARP Cache Poisoning

After receiving fake messages:

• Victim’s ARP table maps router IP to attacker’s MAC

• Router’s ARP table maps victim IP to attacker’s MAC This is known as ARP cache

poisoning.

Step 4: Man-in-the-Middle Attack

All communication is now redirected through the attacker:

A1-29
Victim → Attacker → Router → Internet
Router → Attacker → Victim
The attacker is now positioned between both devices.

The attacker can(effects of ARP spoofing)

• Intercept sensitive data (passwords, messages)

• Modify network traffic
• Redirect users to malicious websites
• Disrupt communication (Denial of Service)

Question No. 6b
Discuss various attacks on Digital signatures. Answer:
Definition
• Digital signatures are cryptographic techniques used to verify the authenticity and
integrity of a message using a pair of public and private keys.
• Despite their strong security features, they are vulnerable to various attacks aimed at
forging signatures or compromising key security.

1. Key Compromise Attack

This attack occurs when an attacker gains access to the signer’s private key, which is
supposed to be secret.

Step-by-Step Working 1. The user stores their private key on a

computer or device.

2. The attacker uses malware, phishing, or system vulnerabilities to access the device.
3. The attacker locates and extracts the private key.
4. Using the stolen key, the attacker generates digital signatures on fake messages.

A1-30
 5. The receiver verifies the signature using the public key and assumes it is valid.

Result

• The attacker successfully impersonates the legitimate user.

• Fake documents are treated as authentic.

2. Replay Attack

In this attack, a valid signed message is captured and resent by the attacker.

Step-by-Step Working

1. The sender transmits a digitally signed message to the receiver.

2. The attacker intercepts and records this message during transmission.
3. The original message reaches the receiver and is accepted.
4. Later, the attacker resends the same signed message.
5. Since the signature is still valid, the receiver accepts it again.

Result

• Duplicate transactions or repeated actions occur.

• Can lead to financial loss or system misuse.

3. Man-in-the-Middle Attack (MITM)

In this attack, the attacker secretly intercepts communication between two parties.

Step-by-Step Working

1. The sender wants to send a signed message to the receiver.

2. The attacker positions themselves between the sender and receiver.
3. The attacker intercepts the sender’s public key exchange.
4. The attacker replaces the sender’s public key with their own key.
5. The receiver uses the attacker’s public key to verify signatures.
6. The attacker can now modify messages and sign them using their own private key.

Result

• The receiver believes the message is authentic.

• The attacker can read and alter communication.

4. Hash Collision Attack

A1-31
This attack targets the hashing process used in digital signatures. It exploits weaknesses in a
Hash Function.

Step-by-Step Working 1. The attacker generates two

different messages:

o One harmless message o

One malicious message
2. The attacker finds a way to make both messages produce the same hash value
(collision).
3. The attacker sends the harmless message to the victim for signing.
4. The victim signs the hash of the harmless message using their private key.
5. The attacker takes the signature and attaches it to the malicious message.
6. Since both messages have the same hash, the signature appears valid.

Result

• The malicious message is accepted as authentic.

• Data integrity is compromised.

5. Chosen Message Attack

In this attack, the attacker tricks the signer into signing specially crafted messages.

Step-by-Step Working 1. The attacker prepares multiple carefully

designed messages.

2. The attacker sends these messages to the signer, requesting signatures (e.g., through a
service).
3. The signer unknowingly signs these messages using their private key.
4. The attacker collects the valid signatures.
5. Using mathematical analysis, the attacker combines these signatures.
6. A new valid signature is generated for a different message without the private key.

Result

• The attacker can forge signatures for unauthorized messages.

• Security of the digital signature system is weakened.

Impacts

A1-32
 • These attacks can compromise data integrity, leading to unauthorized modification of
information.
• They can also result in identity impersonation, financial fraud, and loss of trust in
digital communication systems.

Prevention Techniques
• Strong cryptographic algorithms such as RSA and ECC should be used along with
secure hash functions like SHA-256.
• Proper key management, use of digital certificates, and timestamping mechanisms can
significantly enhance security.

A1-33