1. TOWARDS A FLEXIBLE DATA PROCESSING AND REPORTING STRUCTURE FOR PACKET CAPTURE FILES V 3.0

2. BASIC CONCEPTS Internet background radiation Network telescopes Datasets David promises to elaborate on these further

3. GENERATED REPORTS Two reports generated General report Drill-down report Breakdown of activity in dataset Relevant identifiers

4. WHAT HAS BEEN ACHIEVED Reporting framework that outlines the packet results for a pcap file by month and total dataset Secondary report generation that allows drill-down of results Identification and analysis of malicious packets and attacks captured by darknets

5. SYSTEM

6. CASE STUDIES Have selected some of the results from the project to show its capabilities All of the data sampled from the aforementioned datasets

7. EXAMPLE OUTPUT OF REPORT Source IP addressNumber of packets received Percentage of total packets 146.231.254.65921749.422 146.231.254.119177311.812 146.231.254.114105941.083 146.231.254.11094330.964 146.231.254.11889160.911 146.231.254.14262370.638 146.231.254.12560780.621 146.231.254.6249590.507 146.231.254.848090.492 146.231.254.3647210.483 146.231.254.344910.459 146.231.254.7243580.445 146.231.254.541430.423 146.231.254.7340890.417 146.231.254.5640690.415 146.231.254.2340290.412 146.231.254.8139970.409 146.231.254.7539880.408 146.231.254.16939770.407 146.231.254.1339620.405

8. SOME GREAT ANALYSIS RESULTS Reflected DNS amplification attack DDoS backscatter Changing trends in darknets

9. DNS AMPLIFICATION ATTACK

11. DDOS

13. DARKNET ACTIVITY

14. SSH SCANNING ACTIVITY

15. 12/1301/14 Destination port Number of packets received Percentage of total packets Destination port Number of packets received Percentage of total packets 2212985115.7352233649734.182 809234711.1903389977879.933 3389617717.48580826248.393 445382274.63223653646.640 8080337734.0928080363973.697 Table comparing top 5 TCP destination ports of 146 dataset across two months

16. FUTURE DEVELOPMENT Have real-time version of reporting structure Automatically generate relevant text in document Give document ability to decide whether drill-down report necessary

17. QUESTIONS?