Network Forensics - Detect Flooding Attack on Web Server
The growth of the digital era is seeing a constant rise in threats and attacks on secure networks. This is because the web server is easily accessible and the resources are easily available to the hacker to lead an attack. A web server is an application server where the content on HTTP or HTTPS from the browser and sends it back on the form of pages. It will record the data of every person that visits the web server in the form of logs which will be useful at the time of problems. The network forensic, a field of digital forensics in this context is a computer technology that is used to collect, identify, and test.
The web server attack is of various types including flooding. A flooding attack is an attack that indicates stop services carried from one computer or to many computers at the same time. This is done by spending resources owned by that computer until the computer doesn’t function properly. The flooding attacks are achieved by the usage of a botnet which is a group of internet-connected computers. These are appropriated with the help of malicious malware like Trojan horse.
What is Network Forensic?
Network forensics is defined as capture, recording, and analysis of events of the network to discover the source of attacks or other problem incidents. The network data is obtained from the existing network security appliances such as a firewall or IDS. It is then examined to characterize the attack and then it is investigated to trace back to the attacker. In many cases, the crimes which do not break network security policies but might be legally prosecutable are handled only by Network Forensic Analysis.
Intrusion Detection System (IDS):
An IDS is a software application or hardware device that detects suspicious activity in a network system. Intrusion Detection System (IDS) can perform inspections of inbound and outbound traffic in a system or network. Infiltration process that is, analyzing and finding evidence of experiments is also done by IDS Intrusion Detection System (IDS) can only detect the presence of an intruder to inform the network administrator therefore it is passive. Intrusion Detection System (IDS) is divided into two types.
Network-based Intrusion Detection System (NIDS)
Host-based Intrusion Detection System (HIDS)
Snort is software that detects instruction on the system that is capable of analyzing in real-time traffic and logging IP Address. It will analyze the port and detect all sorts of attacks that are from outside. Snort works in three modes
· Packet Sniffer Mode: Snort works as a sniffer to sniff the data traffic on different computer networks.
· Packet Logger: No packet on the network will be analyzed.
· Intrusion Detection Mode: Snort will detect attacks that were made through a computer network.
Flooding attack detection phase consists of Intrusion Detection System Snort. This configuration is performed to detect flooding attacks on a web server. After this, the next step is flooding and conducting simulated attacks to test whether the IDS Snort has been successfully installed. The snort log files are saved as p.cap which is analyzed later by a Network Analyzer to collect evidence about the intrusion. This is followed by forensic processes which include phase collection, phase examination, phase analysis, and phase reporting.
The IDS system and snort helps in the detection of the web server attack by scrutinizing the security systems activity. This method of Network Security Forensic employs the log files of the web server for analysis by various tools like NETRESEC. This can easily identify the illegal actions performed on web servers and can also prevent future attacks.
