├── img ├── test.txt ├── hulk.gif ├── portscan.gif ├── slowloris.png ├── InputFormat.png ├── golden-eye.png ├── fine-tune-goldeneye.png └── fine-tune-goldeneye-2.png ├── PcapSamples ├── README.md ├── hulk.pcap ├── text.pcap ├── xmas.pcap ├── GoldenEye.pcap ├── nmap_fin.pcap ├── nmap_null.pcap ├── portscan.pcap ├── http_slowloris.pcap ├── discovery_scan_dcerpc_endpoint_mapper.pcapng └── DE_byt3bl33d3r_remote_eventservice_crash.pcapng ├── README.md └── NetworkPcapAnalysis.ipynb /img/test.txt: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /PcapSamples/README.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /img/hulk.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/img/hulk.gif -------------------------------------------------------------------------------- /img/portscan.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/img/portscan.gif -------------------------------------------------------------------------------- /img/slowloris.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/img/slowloris.png -------------------------------------------------------------------------------- /img/InputFormat.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/img/InputFormat.png -------------------------------------------------------------------------------- /img/golden-eye.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/img/golden-eye.png -------------------------------------------------------------------------------- /PcapSamples/hulk.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/hulk.pcap -------------------------------------------------------------------------------- /PcapSamples/text.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/text.pcap -------------------------------------------------------------------------------- /PcapSamples/xmas.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/xmas.pcap -------------------------------------------------------------------------------- /PcapSamples/GoldenEye.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/GoldenEye.pcap -------------------------------------------------------------------------------- /PcapSamples/nmap_fin.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/nmap_fin.pcap -------------------------------------------------------------------------------- /PcapSamples/nmap_null.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/nmap_null.pcap -------------------------------------------------------------------------------- /PcapSamples/portscan.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/portscan.pcap -------------------------------------------------------------------------------- /img/fine-tune-goldeneye.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/img/fine-tune-goldeneye.png -------------------------------------------------------------------------------- /img/fine-tune-goldeneye-2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/img/fine-tune-goldeneye-2.png -------------------------------------------------------------------------------- /PcapSamples/http_slowloris.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/http_slowloris.pcap -------------------------------------------------------------------------------- /PcapSamples/discovery_scan_dcerpc_endpoint_mapper.pcapng: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/discovery_scan_dcerpc_endpoint_mapper.pcapng -------------------------------------------------------------------------------- /PcapSamples/DE_byt3bl33d3r_remote_eventservice_crash.pcapng: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TPs-ESIR-S9/PcapFileAnalysis/HEAD/PcapSamples/DE_byt3bl33d3r_remote_eventservice_crash.pcapng -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 |
17 |
18 | The model is based on BERT (Bidirectional Encoder Representations from Transformers) which is based on the Transformer Neural Network architecture. We appreciated the usage of BERT as it is suitable in the context of analyzing pcap files where bidirectional packets data contexts in the network flow is important.
19 |
20 | Each IP packet in a a loaded pcap file is converted to the format before being processed by the model, pcap/packets manipulation is done using Scapy
21 |
22 | Pcap files that were used for testing & fine-tuning the model were taken from the following sources, they provide a wide range of samples containing benign/malicious activities :
48 |
49 |
52 |
53 | We clearly see that the model has no problem to detect malicious anomaly flows in the network packets capture, he succeed to detect the anomaly type and the tool that was used with precision.
54 |
55 |
58 |
59 |
65 |
66 |
67 |
68 | You could also experiment it by using your own pcap samples or the ones that are provided in this repository.
69 |
70 |
77 |
78 |