Program: B.
Tech-VIII-B/D/C
CSD0802 : Seminar
Submitted By:
ABHILASH SHARMA (BETN1CS21136)
ANUJ SHARMA(BETN1CS21127)
ANUJA SHARMA (BETN1CS21154)
-:Topic:-
“Cyber Threat Detection and Prevention System”
Submitted To:
Mr. Farhan Raza Rizvi
Asst. Professor
Outlines
• 1: Introduction
• [Link] of Network Forensics Investigation
• 3. Loocking for Evidence
• 4. VIRUS LINK Activity
• 5. Network packet capture
1: Introduction
Network forensics is a branch of digital or
computer forensics. It monitors and analyzes
network traffic, events, logs, and
communication patterns after cybersecurity
incidents to gather information, secure legal
evidence, and pinpoint intrusion.
Importance of Network Forensics Investigation
1. Network forensics is the capturing , recording
and analysis of network events in order to
discover the source of security attacks.
2. The capture, recording and anlaysis of network
events in order to discover the source of security
attacks or other problem incidents.
[Link] traffic is transmitted and then
lost. Leaving no cluse behind.
4. An investigator needs to back up these recorded
data to free up recording media and to preserve
the data for future analysis.
5. Network forensics allows us to find the details of
network events after they have happened.
► Identification: recognizing and determining an incident based on network indicators.
This step is significant since it has an impact in the following steps.
► Preservation: securing and isolating the state of physical and logical evidences from
being altered, such as, for example, protection from electromagnetic damage or
interference.
► Collection: Recording the physical scene and duplicating digital evidence using
standardized methods and procedures.
► Examination: in-depth systematic search of evidence relating to the network attack.
This focuses on identifying and discovering potential evidence and building detailed
documentation for analysis.
► Analysis: determine significance, reconstruct packets of network traffic data and draw
conclusions based on evidence found.
► Presentation: summarize and provide explanation of drawn conclusions.
► Incident Response: The response to attack or intrusion detected is initiated based on
the information gathered to validate and assess the incident.
Looking For Evidence
Vulnerabilities: An attacker identifies potential weaknesses in a system, network, and
elements of the network and then tries to take advantage of those vulnerabilities.
The intruder can find known vulnerabilities using various scanners
Trojans: Trojan horses are programs that contain or install malicious programs on targeted
systems. These programs serve as back doors and are often used to steal information from
systems.
E-mail infection: The use of e-mail to attack a network is increasing. An attacker can use e-mail
spamming and other means to flood a network and cause a denial-of-service attack
.Router attacks: Routers are the main gateways into a network, through which all traffic passes.
A router attack can bring down a whole network.
Password cracking: Password cracking is a last resort for any kind of attack .
Ex. Phishing , bruteforce , dictionory attack etc .
Viruses: Viruses are a major cause of shutdown of network components. A virus is a software
program written to change the behaviour of a computer or other device on a network, without
the permission or knowledge of the user.
VIRUS LINK Activity
:-[Link]
8b99c34a791d5d334f08ee1e588c95162290ced38db8b0
92
Network packet capture
This article explains how to use the
built-in Windows packet capture
utility. A packet capture can assist
with troubleshooting while
investigating a network issue.
Resolution
•Open an elevated CMD prompt.
• Open the start menu and
type CMD in the search bar.
• Right click the command
prompt and Run as
Administrator.
•Enter the following command.
netsh trace start capture=yes
•You can use the following command if you want to specify the IP address.
netsh trace start capture=yes [Link]=X.X.X.X
•When completed, run the following command.
netsh trace stop
•Once the data collection has finished, attach both the files ([Link] and
[Link]) to the case; the file location will be displayed in the CMD prompt once
the data collection has been finished.
•These files can be opened with
Microsoft Message Analyzer.
•Once the file has been loaded into Message
Analyzer you can export it to pcap to view in
wireshark.
• First you click Save.
Then
Click Export .
You can now open that file in wireshark and view the packet capture.