SEC 440: Network Forensics

• Introduction
• Types of network forensics
• Setting up the environment for analysis
• Case study: Suspicious Web Server
• Introduction to Protocols and Deep Packet Analysis
• The OSI model
• The TCP/IP model
• The Packet structure
• Case study: Curious case of protocol misuse
• Deep Packet Inspection
• Case study: Investigating Distributed Denial of service attacks

3 LiveLab in this lesson — see the labs panel →

• Introduction
• Statistical Flow analysis
• Flow Record and FRP Systems
• Uniflow and BitFlow
• Types of Sensor deployment
• Flow analysis
• Introduction to Conducting Log Analysis
• Investigating Remote Login attempts on SSH
• Investigating Web Server Attacks with Splunk
• Investigating Proxy Logs

4 LiveLab in this lesson — see the labs panel →

• Introduction
• Basics of Radio Frequency Monitoring
• The 802.11 standard
• Evidence types in wireless local area networking
• Other wireless attacks and their analysis
• Introduction to TLS Decryption and Visibility
• Techniques to decrypt SSL/TLS communication
• Examining SSL/TLS traffic using proxy

2 LiveLab in this lesson — see the labs panel →

• Introduction
• Identifying covert communication using proxies
• Using MitmProxy to decrypt Dropbox traffic
• Using Dropbox API to gather attack details
• Uncovering the attack pattern
• Uncovering DNS misuse
• DNS Exfiltration
• Understanding SmokeLoader and GuLoader
• Suricata
• Network forensics with Security Onion
• Extracting malicious payload
• Using Fakenet-Ng to simulate a network

3 LiveLab in this lesson — see the labs panel →

• Introduction
• Parsing the Syslog format
• IP reputation analysis
• Writing dissectors for protocols in Lua
• Introduction to Backtracking Malware
• Investigating Cobalt Strike Encrypted traffic
• Investigating TeamViewer and AnyDesk

3 LiveLab in this lesson — see the labs panel →