Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
CSC3064 Practical Assessment
Objective
You have just started a new job as network security analyst at a Security Operations Center (SOC).
Your job is to investigate network based cyber-attacks affecting customers of the SOC.
Your manager has asked you to investigate a network packet capture containing malware-related
network activity, which was taken from a customer’s network a few years ago.
You have been asked to provide an analysis of what you think happened during the packet capture
and provide a concise presentation of your findings (according to the requirements on page 2).
The packet capture, called CSC3064-Assessment.pcap, is available to download from Canvas.
This assessment is worth 40% of the available module marks.
You are required to submit a single video file, submitted via the Canvas Assignments page.
The submission deadline is 16:00 on 7 March 2022.
If you have a question about this assessment email [email protected]
2
Requirements
You are required to produce a video report that addresses the following two points:
1. Basic Summary
Must include:
• Identify the IP addresses of hosts that communicated with each other. Very briefly,
discuss any basic insights gained from this information.
• Identify all protocols in the capture higher than OSI layer 4. For each protocol
identified, state the percentage of bytes in the capture belonging to that protocol.
2. Analysis in Wireshark
Must include:
• A verbal explanation of what you think happened in the network. Identify the name
of the malware if you can. Consider a timeline of the communications that took
place, supported by evidence displayed in Wireshark.
• Discuss any successful or unsuccessful operations associated with the malware, and
identify any vulnerabilities you believe were successfully exploited via the network.
• Identify any network-based Indicators of Compromise (IOC) that you think are useful
from a network security perspective, and describe how they could be used
effectively in the prevention or detection of similar kinds of attack in the future.
You must justify your findings with evidence, based on the operations observed in the
network packet capture.
In your video report, discuss and display specific individual packets, protocol information,
headers, IP addresses, etc. (anything you think is relevant), with commentary about how the
information supports your theories or conclusions about what happened in the network.
Examples for guidance:
If you conclude the capture shows a TCP SYN flood attack, you might show evidence such as:
• Wireshark statistics that support this conclusion,
• Data showing a very large number of TCP packets with the SYN flag set,
• The IP address of the host that you believe is the target of the attack,
• and so on…
To “justify your findings” you do not need to reference external sources as evidence to explain what
SYN floods look like. References are not required.
If you conclude the capture shows CryptoLocker ransomware, you should not go into detail about
host or software related operations, such as “the malware adds a key to the registry that causes it to
run on startup”. These are not network-related operations, are not visible in the capture, and are
not relevant for this particular security analysis.
3
About the capture file:
A packet has been removed from the original capture to ensure minimal cyber security risks
associated with the content of the capture. This will not affect or hinder your ability to analyse the
capture.
The hosts recorded in the file are not believed to pose a current security risk, however it is
recommended that you do not visit any hosts that you discover, as this is not necessary for your
investigation.
Guidance on Video
As guidance, you should aim for around 5 minutes, but you must not exceed 6 minutes. Any videos
longer than 6 minutes will be awarded 0 marks for quality of presentation.
You may structure your video in whatever way you feel most effectively communicates your findings
in a concise, technically detailed, and professional manner. However, the following approach is
strongly recommended:
Basic Summary
• Aim for around 1 minute.
• Use a PowerPoint slide to present the required information with a brief and focused
discussion.
Analysis in Wireshark
• Aim for around 4 minutes.
• Present your evidence using the Wireshark tool. Discuss your theories and justifications by
stepping through any evidence you think supports your findings.
• You may wish to intersperse your discussion with 1 or 2 brief PowerPoint slides to identify
key points that you want to emphasise (but don’t waste time repeating the same
information). For example, you may wish to conclude with a slide to discuss Indicators of
Compromise (IOC).
• However, your primary aim is to demonstrate effective practical skills in network security
analysis and competent use of Wireshark, so most of your time must be spent working
within Wireshark.
Regarding the presentation format and the audience, keep in mind the audience for your
presentation is your manager at a Security Operations Center. The information you present must
appear professional. It should be informative and convey depth of detail, but be concise.