Graphical analysis of captured network packets for detection of suspicious network nodes

No ratings

Presented at CyberScience2020 2020 by

Felix Aryeh

Boniface Olasehinde

The advent of the Internet has yielded the rapid development of Information Technology relatedapplications over the past two decades. Most organizations have adopted the use of a computer network to makeaccessibility and sharing of network applications and devices possible. However, currently, network security hasbeen one of the critical things most organization and corporation has to handle. Each day, attacks are continuallybeing executed into professional secured corporate or organization networks and sometimes into private networks.Wireshark is a tool generally used for network packet capture however, it is very tedious sometimes to filter andfollow TCP streams. This problem exacerbates in a situation where huge network data or traffic needs to be analyzedfor suspicious traffic. This paper leverages the use of Python libraries and Data Science techniques to ease thepacket capturing and analysis process. By using these techniques will enhance the gleaning out more interestingattributes of network packet and fish out the suspicious IP address, network ports or malicious data readily within theshortest possible time. The research conducted showed how a broadcast IP address 255.255.255.255 might besuspicious within the internal network of UMaT. The suspicion was based on the payload data sent to this addressand a possible error or misconfiguration on the Ubiquiti UniFi access point.