Reference no: EM133535837

Advanced Network Security

Virtnet
Questions 1 and 3 require you to use virtnet topology 5. The questions are related, so you must use the same nodes for all three questions.
• node1: client; assumed to be external from the perspective of the firewall.

• node2: router; gateway between the internal network and external network. Also runs the firewall.
• node3: server; assumed to be internal from the perspective of the firewall. Runs a web server with HTTPS and a SSH server for external users (e.g. on node1) to login to. Will contain accounts for multiple users.

Question 1. HTTPS and Certificates
For this question you must use virtnet (as used in the Tutorials) to study HTTPS and certificates. This assumes you have already setup and are familiar with virtnet. See Moodle and workshop instructions for information on setting up and using virtnet, deploying the website, and testing the website.
Your task is to setup a web server that supports HTTPS. The tasks and sub-questions are grouped into multiple phases.
Phase 1: Setup Topology
1. Create topology 5 in virtnet.
2. Deploy the MyUni demo website, with node3 being the real web server.

Phase 2: Certificate Creation
1. Using[studentID]-keypair.pem from Assignment 1, generate a Certificate Signing Request called [StudentID]-csr.pem. CSR must contain these field values:
• State: state of your campus
• Locality: city of your campus
• Organisation Name: your full name
• Common Name: www.[StudentID].edu
• Email address: your @cqumail address
• Other field values must be selected appropriately.

Now you will change role to be a CA. A different public/private key pair has been created for your CA as [StudentID]-ca-keypair.pem. As the CA you must:

2. Setup the files/directories for a demoCA
3. Create a self-signed certificate for the CA called [StudentID]-ca-cert.pem.
4. Using the CSR from step 1 issue a certificate for www.[StudentID].edu called
[StudentID]-cert.pem.

Phase 3: HTTPS Configuration
1. Configure Apache web server on node3 to use HTTPS where the domain name is www.[StudentID].edu
2. Load the CA certificate into the client on node1.

Phase 4: Testing
1. Start capturing on node2 using tcpdump.

2. On node1, use lynx to visit https://www.[StudentID].edu/grades/ and login to view somegrades.

3. Demonstrate to your tutor that your secure website is operating correctly.
3. Exit lynx.
4. Stop the capturing and save the file as [StudentID]-https.pcap.

When capturing, make sure you capture a full HTTPS session, and avoiding capturing multiple sessions.
For on-campus students: Step 3 of above should be demonstrated in your allocated Week 9, 10, 11 or Week 12 tutorial class. Your local tutor will be informed you when your demonstration is passed.
For distance students: Unit Coordinator will organise a time for you to demonstrate step 3.

Phase 5: Analysis

(a) Demonstration of secure web site

(b) Submit the following packet capture [StudentID]-https.pcap on Moodle

(c) Draw a message sequence diagram that illustrates the TLS/SSL packets belonging to the first HTTPS session in the file. Refer to the instructions in assignment 1 for drawing a message sequence diagram, as well as these additional requirements:
• Only draw the TLS/SSL packets; do not draw the 3-way handshake, TCP ACKs or connection close. Hint: identify which packets belong to the first TCP connection and then filter with "ssl" in Wireshark. Depending on your Wireshark version, the protocol may show as "TLSv1.2".
• A single TCP packet may contain one or more SSL messages (in Wireshark look inside the packet for each "Record Layer" entry to find the SSL message names). Make sure you draw each SSL message. If a TCP packet contains multiple SSL messages, then draw multiple arrows, one for each SSL message, and clearly label each with SSL message name.

Reflection:

• Clearly mark which packets/messages are encrypted.

(d) Generally, Certificate Authorities must keep their private keys very secure by storing them offline in special hardware devices. How attackers can introduce attacks to https://www. [StudentID].edu if they able to compromise the CA private key. [3 mark]

Question 2. Attack Detection from Real Intrusion Dataset

This task is the continuation of the question 2 Assignment 1 where you have evaluated the UNSW-NB15 dataset with three different classifiers where you did not apply any feature selection techniques. Feature selection is one of the key principles that greatly impacts the model's efficacy by selecting only those features that are most relevant and thereby, reduces over-fitting, improves accuracy and reduces training time. Here you need to explore different built-in feature selection techniques (at least three) in WEKA and identify the best features for each classifier.

For this task you will need two files available on Moodle:

• train.arff and test.arff.

You need to follow the following steps:
• Step 1: Import data in the train.arff into WEKA (explorer).
• Step 2: Select the attributes by using Attribute evaluator (at least 2) and search method in WEKA and update your datasets accordingly.
• Step 3: Select the classifier that you used in Assignment 1 Question 2.
• Step 4: Specify the test option as Use ‘training set' and the column of class.
• Step 5: Supply the test dataset (test.arff) to evaluate the classifier.
• Step 6: Re-evaluate model on current test set to perform the evaluation.
• Repeat the step 2 to 7 for other two classifiers.

You need to include in your report the following:

(a) Screenshot of the selected attributes and evaluation result for each classifier.
(b) Compare your current outcomes with the outcomes of Question 2 Assignment 1 in term of Accuracy, precision, recall, F1-Score and false positive rate.

Reflections:

(c) Have you achieved better performance after applying the feature selection technique for each classifier? If yes, why you have achieved that. If yes, explain why you believe that was achieved. If not, explain why you believe it was not achieved.
(d) In the UNSW-NB15 dataset, there are nine types of network attacks available. Among these nine attacks which three attacks are highly detected by the classifiers? Please give a short explanation of these three attacks.

Question 3. Firewalls and Wi-Fi Security

You are tasked with designing a network upgrade for a manufacturing institute. The institute currently has a wired network (Ethernet LAN) across three floors of their office building, connecting approximately 50 desktop computers, several servers and 15's of other devices (e.g., printers, payment terminals, machinery). There are currently 80 full-time and part-time employees, some working in the office while others are outside or in an external workshop. The network upgrade has two main components:
• A wireless LAN to allow all employees access to the internal network from within the office, outside and in the workshop. Customers of the business may also be granted guest access to the wireless LAN. The wireless LAN will most likely need more than 20 APs and have 120 to 170 clients.
• A VPN to allow selected employees to access the internal network from home or when visiting customers at other locations.
Assume the network has the following internal servers:
• A web server that supports HTTPS only and is accessible to the public.
• An email server accessible to the public.
• A SSH server accessible only to a small selection of employees when they are outside of the network. (The VPN is not needed for these employees to access the SSH server)
The institute has one IT employee who is capable with computer networking (e.g., they previously setup the wired LAN), but has little knowledge of security. Answer the following questions assuming that you are explaining to the IT employee (as they need to build the network).

(a) Draw a network diagram that illustrates the wired network, wireless network, and VPN. You should not draw all users and devices; only draw a sample of the users and devices. For example, several switches, several APs, several wired computers, several WiFi users, 1 or 2 VPN external users. (Several may be 2 to 5). Also, clearly indicate which portions of the network have data encrypted due to either WiFi encryption or the VPN (for example, mark those paths that have encryption in red or some other clear label).

(b) Explain where you would locate the firewall and justify that location.

(c) Design a set of firewall rules for the organisation. Implement a set of firewall rules in virtnet on node2 in topology 5 using iptables. Explain any rules that are important for the institute, but you are not able to implement it because of limited virtnet environment with iptables. Include the iptables rules in your report.

(d) The institute network included a wireless LAN component. Based on "Wi-Fi Security" research article, recommend two security mechanisms that the institute could use to reduce the risk of the threats. For each security mechanism you recommend, explain what the security mechanism does, which threat(s) it addresses, and how it reduces the threat.

Maintaining Journal

Whenever you perform tasks, you should be recording important information in your online journal. This may include notes, commands you have run, parts of files you edited, and screenshots. You will be marked on how well you have maintained your journal (including technical depth) and how accurately it captures your tutorial and assignment practical activities from Week 6 to Week 10. Your online journal may be also referred to when marking your submission. For example, if the marker sees two student submissions with very similar answers, they may refer to the journal to review the entries that indicate that both students performed the tasks independently.
To gain the full 5 marks, your journal at least has to contain evidence on the following practical tasks:
- Firewalls (week 6)
- Authentication (week 7)
- Access control (week 8)
- Wireless security (week 10)

Attachment:- Advanced Network Security.rar